Administrative Simplification: Rescinding the Adoption of the Standard Unique Health Plan Identifier and Other Entity Identifier, 65118-65127 [2018-27435]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 83, Number 243 (Wednesday, December 19, 2018)]
[Proposed Rules]
[Pages 65118-65127]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2018-27435]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 162

[CMS-0054-P]
RIN 0938-AT42


Administrative Simplification: Rescinding the Adoption of the 
Standard Unique Health Plan Identifier and Other Entity Identifier

AGENCY: Office of the Secretary, HHS.

ACTION: Proposed rule.

-----------------------------------------------------------------------

SUMMARY: This proposed rule would rescind the adopted standard unique 
health plan identifier (HPID) and the implementation specifications and 
requirements for its use and the other entity identifier (OEID) and 
implementation specifications for its use. The decision to propose to 
rescind the adopted standards was made following a careful assessment 
of industry input, as well as HHS's intention to explore options for a 
more effective standard unique health plan identifier in the future.

DATES: To be assured consideration, comments must be received at one of 
the addresses provided below, no later than 5 p.m. on February 19, 
2019.

ADDRESSES: In commenting, please refer to file code CMS-0054-P. Because 
of staff and resource limitations, we cannot accept comments by 
facsimile (FAX) transmission.
    Comments, including mass comment submissions, must be submitted in 
one of the following three ways (please choose only one of the ways 
listed):
    1. Electronically. You may submit electronic comments on this 
regulation to https://www.regulations.gov. Follow the ``Submit a 
comment'' instructions.
    2. By regular mail. You may mail written comments to the following 
address ONLY: Centers for Medicare & Medicaid Services, Department of 
Health and Human Services, Attention: CMS-0054-P, P.O. Box 8013, 
Baltimore, MD 21244-8013.
    Please allow sufficient time for mailed comments to be received 
before the close of the comment period.
    3. By express or overnight mail. You may send written comments to 
the following address ONLY: Centers for Medicare & Medicaid Services, 
Department of Health and Human Services, Attention: CMS-0054-P, Mail 
Stop C4-26-05, 7500 Security Boulevard, Baltimore, MD 21244-1850.
    For information on viewing public comments, see the beginning of 
the SUPPLEMENTARY INFORMATION section.

FOR FURTHER INFORMATION CONTACT: 
    Lorraine Doo, (410) 786-6597, for all policy questions.
    Rosali Topper, (410) 786-7260, for information about website 
content and frequently asked questions.
    Gladys Wheeler, (410) 786-0273, for information about the Health 
Plan and Other Entity Enumeration System (HPOES).
    Heinz Stokes-Murray, (410) 786-0383, and LaKisha Brown, (410) 786-
1798, for general information.

SUPPLEMENTARY INFORMATION: 
    Inspection of Public Comments: All comments received before the 
close of the comment period are available for viewing by the public, 
including any personally identifiable or confidential business 
information that is included in a comment. We post all comments 
received before the close of the comment period on the following 
website as soon as possible after they have been received: https://www.regulations.gov. Follow the search instructions on that website to 
view public comments.

I. Background

A. Statutory and Regulatory History

    Section 262 of the Health Insurance Portability and Accountability 
Act of 1996 (HIPAA) (Pub. L. 104-191) added section 1173 to the Social 
Security Act (the Act) and required, among other things, that the 
Secretary of the Department of Health and Human Services (HHS or the 
Secretary) adopt a standard unique health plan identifier. The stated 
purpose of section 261 of HIPAA is to improve the effectiveness and 
efficiency of the health care system by encouraging the development of 
a health information system through the establishment of standards and 
requirements for the electronic transmission of certain health 
information and reducing the clerical burden on patients, health care 
providers, and health plans.
    Section 1173(b)(1) of the Act specifies that, in adopting a 
standard unique identifier for health plans, the Secretary must take 
into account multiple uses for the identifier, and section 1173(b)(2) 
of the Act provides that, in adopting a standard health plan 
identifier, the purposes for which the identifier may be used must be 
specified. Congress renewed the requirement for the Secretary to adopt 
a standard unique health plan identifier in section 1104(c)(1) of the 
Patient Protection and Affordable Care Act (Pub. L. 111-148) ((as 
amended by the Health Care and Education Reconciliation Act of 2010 
(Pub. L. 111-152) and collectively known as the Affordable Care Act) by 
requiring the Secretary to promulgate a final rule to establish a 
unique health plan identifier, as described in section 1173(b) of the 
Act and based on the input of the National Committee on Vital and 
Health Statistics (NCVHS).
    To implement these statutory provisions, we adopted the HPID and 
OEID via a final rule published on September 5, 2012 (77 FR 54664) 
entitled Administrative Simplification: Adoption of a Standard for a 
Unique Health Plan Identifier; Addition to the National Provider 
Identifier Requirements; and a Change to the Compliance Date for the 
International Classification of Diseases, 10th Edition (ICD-10-CM and 
ICD-10-PCS) Medical Data Code Sets (hereafter, referred to as the 
September 2012 final rule). The September 2012 final rule did the 
following:
     Adopted the HPID as the standard unique identifier for 
health plans.
     Defined the terms ``Controlling health plan'' (CHP) and 
``Subhealth plan'' (SHP). The definitions of these two terms 
differentiate health plan

[[Page 65119]]

entities that are required to obtain an HPID and those that are 
eligible, but not required, to obtain an HPID.
     Required all covered entities to use an HPID whenever a 
covered entity identifies a health plan in a covered transaction.
     Established requirements for CHPs and SHPs in order to 
enable health plans to obtain HPIDs to reflect different business 
arrangements so they can be identified appropriately in HIPAA 
transactions.
     Adopted a data element to serve as an ``other entity 
identifier'' (OEID).
    ++ The OEID functions as an identifier for entities that are not 
health plans, health care providers, or individuals (including, for 
example, third party administrators, transaction vendors, 
clearinghouses, and other payers), but that need to be identified in 
HIPAA transactions.
    ++ Did not require other entities to obtain an OEID, but permitted 
them to obtain and use one if they need to be identified in covered 
transactions.
    For more detailed information regarding the statutory and 
regulatory history of the HPID and OEID or HIPAA legislation and 
regulations, see the April 17, 2012 proposed rule titled 
``Administrative Simplification: Adoption of a Standard for a Unique 
Health Plan Identifier; Addition to the National Provider Identifier 
Requirements; and a Change to the Compliance Date for ICD-10-CM and 
ICD-10-PCS Medical Data Code Sets'' (77 FR 22952 through 22954), 
(hereinafter referred to as the April 2012 proposed rule) and the 
September 5, 2012 final rule (77 FR 54666).

B. Adoption of the Health Plan Identifier (HPID) and Other Entity 
Identifier (OEID)

    The NCVHS Subcommittee on Standards conducted a public hearing 
about the health plan identifier between July 19 and 21, 2010. Industry 
stakeholders--including representatives from health plans, health care 
provider organizations, health care clearinghouses, pharmacy industry 
representatives, standards developers, professional associations, 
representatives of Federal and State public programs, the Workgroup on 
Electronic Data Interchange (WEDI), the National Uniform Billing 
Committee (NUBC), the National Uniform Claim Committee (NUCC), and 
individuals with health plan identifier proposals--provided in-person 
and written testimony at the hearing. Stakeholder testimony focused on 
the use and need for an HPID to: Facilitate the appropriate routing of 
HIPAA transactions; reduce the cost of managing financial and 
administrative information; reduce dissatisfaction among health care 
providers and patients/members by improving communication with health 
plans and intermediaries; and provide information about health plan 
products and benefits. Stakeholders provided suggestions on the types 
of entities to be identified in HIPAA transactions, those that should 
be eligible to obtain an HPID, and the level of enumeration needed for 
each plan (for example, the legal entity, product, and benefit 
package). For a full discussion of the key topics and recommendations 
from that NCVHS hearing, see the April 2012 proposed rule (77 FR 22956 
and 22957).
    Following the hearing in 2010, the NCVHS submitted recommendations 
to the Secretary regarding the HPID, including definitions and types of 
entities that should be eligible for enumeration. In that 
recommendation letter, the NCVHS advised HHS to collaborate across 
federal agencies and to request stakeholder input on each topic through 
national associations, Designated Standards Maintenance Organizations 
(also known as standards development organizations or SDOs), and WEDI. 
The letter included observations relating to the levels of entity 
enumeration, and the format and content of the HPID. It also included 
recommendations for a publicly accessible directory database to support 
the enumeration system and process, as well as testing, use of the HPID 
on a health plan ID card, exempting its use in pharmacy transactions, 
and improving its use through operating rules. The full text of the 
letter can be found on the NCVHS website at: https://www.ncvhs.hhs.gov/wp-content/uploads/2014/05/100930lt1.pdf.
    After the receipt of the NCVHS recommendations, and upon internal 
review, HHS published the April 2012 proposed rule incorporating 
several of the recommendations, including the following proposals:
     The adoption of a standard for a unique health plan 
identifier, the HPID, for use in HIPAA transactions.
    ++ The concepts of Controlling health plan and Subhealth plan.
    ++ The requirement that all controlling health plans, including 
self-funded health plans, obtain an HPID.
     The creation of a new data element--the OEID--for use by 
entities that do not meet the definition of a health plan, but that 
need to be identified in HIPAA transactions.
     Requirements and provisions for the implementation of the 
HPID and OEID.
    The policy in the September 2012 final rule (77 FR 54666 and 54667) 
that requires health plans to enumerate with an HPID attempted to 
address the issues associated with health plans being identified in 
HIPAA transactions with different numbers originating from multiple 
sources and with multiple, proprietary formats. We believed that the 
various identifiers, assigned by different governmental or private 
organizations, were the identifiers health plans used to represent 
themselves in the HIPAA transactions. These identifiers included the 
National Association of Insurance Commissioners' (NAIC) Company code, 
the U.S. Department of Labor (DOL) and the Internal Revenue Service 
(IRS) Employer Identification Number (EIN) number, the Tax 
Identification Number (TIN), and proprietary numbers assigned by 
clearinghouses. We refer herein to the various identifiers that 
identify payers in the HIPAA transactions as Payer IDs. We did not 
define the term payer in the September 2012 final rule, but are aware 
that while the industry uses the terms payer and health plan 
interchangeably, they do not have the same meaning when referenced for 
purposes of a transaction.
    We believed our policies specifying requirements for health plans 
to obtain identifiers, and use them in HIPAA transactions when 
appropriate, resolved, or took steps towards resolving, the issues of 
transaction routing, difficulty determining patient eligibility, and 
challenges identifying the health plan during claims processing. 
Specifically, we assumed the HPID framework, with the use of CHPs and 
SHPs, would address any industry confusion of having multiple ways to 
identify a health plan in a transaction. In the September 2012 final 
rule (77 FR 54667), we explained which entities would be required to 
obtain and use an HPID in HIPAA transactions in order to identify the 
plan in the appropriate loops and segments of the transactions. We 
stated that we believed the adoption of the HPID and the OEID would 
increase standardization within HIPAA transactions and provide a 
platform for other regulatory and industry initiatives, and that their 
adoption would allow for a higher level of automation for health care 
provider offices, particularly for provider processing of billing and 
insurance-related tasks, eligibility responses from health plans, and 
remittance advice that describes healthcare claim payments.
    However, the importance of the distinction between the HPID and 
Payer IDs, and the industry's use of, and reliance on, Payer IDs in the 
HIPAA

[[Page 65120]]

transactions, became evident after publication of the September 2012 
final rule when health plans and insurers began to prepare for 
enumeration and realized the impact of having to accommodate the HPID 
rather than a Payer ID in the HIPAA transactions.

C. Events Leading to This Proposed Rule

    After publication of the September 2012 final rule, we conducted 
outreach on the enumeration process (for example, we held webinars and 
attended industry conferences), published guidance on our website, and 
hosted an email box to receive industry inquiries. Through these 
initiatives, we received questions from health plans and providers 
about a number of issues, including: How many HPIDs health plans should 
obtain; why self-funded plans were being required to obtain an HPID; 
how the HPID and Payer IDs were to be used together in the HIPAA 
transactions; whether certain providers could or should obtain OEIDs 
(for example, atypical providers); which HPID would be used for 
enforcement actions; and whether or how the HPID database would be made 
accessible to industry for look-up and verification. In October 2012, 
organizations began to apply for HPIDs, and 11,000 numbers were 
assigned between that date and October 2014. As the enumeration process 
began, professional associations for both health plans and health care 
providers submitted feedback that stated there was no need for the HPID 
in HIPAA transactions, and that the policy requirements were 
problematic, costly, and burdensome.
    The NCVHS Standards Subcommittee held a hearing on February 19, 
2014, and sent a letter to the Secretary on May 15, 2014, summarizing 
participant comments and providing recommendations (https://www.ncvhs.hhs.gov/wp-content/uploads/2014/05/140515lt2.pdf).
    The NCVHS wrote:

    [T]estifiers indicated that there is confusion on how the HPID 
and OEID should be used. Many health plans face challenges with 
respect to the definitions of controlling health plan (CHP) and sub-
health plan (SHP); the use of HPID for group health plans that do 
not conduct HIPAA standard transactions (the self-insured plans); 
and the cost to health plans, clearinghouses and providers because 
software has to be modified to account for the HPID. Testifiers 
questioned the impact on health plans, third-party payers (TPAs) and 
Administrative Services Only (ASO) self-insured groups and the 
degree of granularity required to enumerate. Others expressed 
concerns that the HPID database would not be accessible and without 
public access to the HPID database, the identifier is of no value to 
trading partners; validation cannot be performed; a crosswalk would 
not be possible among Medicaid proprietary plans, and the data 
collection did not include reference to the Bank Identification 
Number/Processor Control Number (BIN/PCN) used in pharmacy claims 
processing. Concern was also expressed that self-insured health 
plans are not aware of the requirements that apply to them.\1\
---------------------------------------------------------------------------

    \1\ https://www.ncvhs.hhs.gov/wp-content/uploads/2014/05/140515lt2.pdf.

    On June 10, 2014, the NCVHS held another hearing and sent a follow-
up letter to the Secretary on September 23, 2014 titled ``Letter to the 
Secretary, Findings from the June 2014 NCVHS Hearing on Coordination of 
Benefits, Health Plan Identifier (HPID), and ICD-10 Delay,'' in which 
it recommended that HHS specify that the HPID not be used in HIPAA 
transactions, that the HPID's use be better clarified, and that the 
HPID not replace the existing Payer IDs. See https://www.ncvhs.hhs.gov/wp-content/uploads/2014/10/140923lt5.pdf. Specifically, the NCVHS 
highlighted the following items from the June 2014 stakeholder 
testimony:
     Lack of clear business need and purpose for using HPID and 
OEID in health care administrative transactions.
     Confusion about how the HPID and OEID would be used in 
administrative transactions, including strong concerns that HPID might 
replace current Payer IDs which were widely in use between covered 
entities.
     Challenges faced by health plans with respect to the 
definitions of CHPs and SHPs.
     Use of the HPID for group health plans that do not conduct 
HIPAA transactions.
     Cost to health plans, clearinghouses, and providers for 
modifying software to account for the HPID.
    In response to the NCVHS's 2014 recommendations, HHS took two 
administrative actions.
    First, on October 31, 2014, through a statement of enforcement 
discretion,\2\ HHS delayed enforcement of the regulations pertaining to 
HPID enumeration and use of the HPID in the HIPAA transactions in order 
to review the NCVHS' recommendations and to consider any appropriate 
next steps. The enforcement discretion, which remains in effect, means 
that HHS will not impose penalties if it determines a covered entity is 
out of compliance with the HPID requirements of the September 2012 
final rule.
---------------------------------------------------------------------------

    \2\ Statement of Enforcement Discretion regarding 45 CFR 162 
Subpart E--Standard Unique Health Identifier for Health Plans 
https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/Unique-Identifier/HPID.html.
---------------------------------------------------------------------------

    The effect of the enforcement discretion has been two-fold: (1) In 
general, it appears that industry has taken little action to implement 
the requirements of the September 2012 final rule; and (2) we have not 
published any further educational, outreach, or guidance materials on 
the industry's use of the HPID and OEID.
    Second, in the May 29, 2015 Federal Register (80 FR 30646), we 
published a request for information (RFI) to solicit additional public 
input to determine whether HPID policies were still warranted. Through 
the RFI, we sought public comment on three (3) topics: (1) The HPID 
enumeration structure, including the use of the CHP/SHP and OEID 
concepts; (2) use of the HPID in HIPAA transactions in conjunction with 
the Payer ID; and (3) whether changes to the nation's health care 
system since the issuance of the September 2012 final rule had altered 
perspectives about the need for the HPID.
    We received 53 timely comments in response to the RFI, with the 
overwhelming majority of submissions recommending that the HPID not be 
required in the HIPAA transactions, either alone or in combination with 
the Payer IDs. A small minority of commenters continued to support the 
concept of a standard health plan identifier, though not the specific 
HPID adopted by HHS, believing it may have some value for enforcement 
or HIPAA health plan certification of compliance. Although many 
commenters acknowledged that they had supported the creation of a 
standard health plan identifier in the proposed rule and understood its 
policy intent, in response to the RFI they warned that inclusion of the 
HPID in the transactions would create significant administrative 
problems without corresponding benefit due, at least in part, to a 
confusing framework.
    A commenter stated that, regardless of the enumeration schema, 
converting from the Payer IDs to the HPID would be costly for all 
stakeholders because of the potential for misrouting transactions and 
disrupting claims processing, while multiple commenters indicated that 
the health care community had become adept at using the Payer IDs, and 
that those, along with the operating rules, were enabling benefits and 
cost savings of the HIPAA transactions.
    In response to the third topic in the RFI, ``whether the changes in 
health care had altered perspectives about the need for an HPID,'' some 
commenters stated that too much time had elapsed since industry had 
been using the Payer

[[Page 65121]]

IDs in transactions, and the industry had established appropriate 
routing technologies. These commenters said that the requirement for a 
standard unique health plan identifier no longer represented best 
practices for how information was exchanged between health plans and 
health care providers. A number of commenters stated that the health 
care system was continuing to undergo innovation and experimentation 
with care delivery and payment models. These commenters noted that the 
market required flexibility to enable continued innovation to mature, 
and suggested that HHS allow payers, clearinghouses, and third party 
administrators more time to adapt to the evolving health care 
environment before implementing a unique health plan identifier. Other 
commenters stated that if there were other proposed purposes or future 
use cases for a standard health plan identifier, a lawful and 
compelling business case for its intended use should be made and 
sufficient opportunity for comment be available in the Federal 
Register. We did not receive specific recommendations or alternative 
proposals for consideration.
    In summary, from the NCVHS hearings as well as comments on the May 
2015 RFI, several common themes emerged. First, the industry already 
has satisfactorily functioning mechanisms to route claims and other 
HIPAA transactions using the existing Payer IDs. Second, it would 
likely be a costly, complicated, and burdensome disruption for the 
industry to have to implement the HPID because it would require mapping 
existing Payer IDs to the new HPIDs, which would likely result in the 
misrouting of claims and other transactions. Third, the HPID framework 
does not provide added value for other anticipated purposes, such as 
including certain information in the transaction, including the name of 
the health plan name, the level of benefits or coverage description 
(medical, dental, vision, pharmacy), or co-payment and co-insurance 
responsibility for certain services (for example, certain optional and 
required coverage types).
    The Affordable Care Act amended HIPAA to require the Secretary to 
adopt a set of operating rules for each of the HIPAA transactions with 
the intent of creating as much uniformity in the implementation of the 
HIPAA standards as possible. Operating rules are business rules for the 
exchange of electronic information, and are not already defined by a 
standard. HHS named the Council for Affordable Quality Healthcare 
(CAQH) Committee on Operating Rules for Information Exchange (CORE) the 
authoring entity for the operating rules, which labels its operating 
rules in Phases as they are developed and approved. To date, HHS has 
adopted operating rules for three HIPAA transactions--eligibility for a 
health plan, health care claim status, and health care electronic funds 
transfers (EFT) and remittance advice. On July 8, 2011, HHS adopted the 
CAQH CORE Phase I and Phase II operating rules for the eligibility for 
a health plan and health care claim status transactions (77 FR 40458), 
and on August 10, 2012, HHS adopted the CAQH CORE Phase III operating 
rules for the health care electronic funds transfers (EFT) and 
remittance advice transaction (77 FR 48008). For additional information 
about the operating rules and the designation of the operating rules 
authoring entity, we refer the reader to the July 8, 2011 interim final 
rule (77 FR 40458) and the August 10, 2012 interim final rule (77 FR 
48008).
    Specific to the HPID and challenges for its use with eligibility 
for a health plan and claim status transactions, the operating rules 
require that coverage description data elements be provided by a health 
plan in HIPAA transactions (CORE Phase I Operating Rule 154 and CORE 
Phase II Operating Rule 260: Eligibility & Benefits (270/271) Data 
Content Rule version 2.1.0 March 2011).\3\ For example, health plans 
must support an explicit request for content related to 12 service 
types specified in the Phase I operating rules in the eligibility 
transaction, and the Phase II operating rule provides a list of 51 
service types for which health plans must provide some type of 
information to providers in both the eligibility and claim status 
responses. Providers need information about health plan coverage type 
along with a Payer ID to successfully determine: If an individual is 
eligible for services, what coverage can be provided, the co-payments 
that are due, and where to submit the final claim for processing. The 
operating rules combined with Payer IDs enable improved communication 
between health plans and providers. The HPID as adopted does not enable 
information about benefits, coverage, or payment, in part because it is 
only to be used for routing, and in part because it does not contain 
any ``intelligence'' about the health plan with which the coverage for 
the patient is associated.
---------------------------------------------------------------------------

    \3\ https://www.caqh.org/core/caqh-core-phase-ii-rules. For a 
Direct link to the Phase II Operating Rules.
---------------------------------------------------------------------------

    On May 3, 2017, the NCVHS held another hearing on the HPID to 
solicit industry input on the business needs for the HPID, its use in 
HIPAA transactions, and to confirm whether the testimony from the 2014 
and 2015 NCVHS hearings was still valid. The questions for testifiers 
were as follows:
     What identifiers are used today and for what purpose?
     What business needs do you have that are not adequately 
met with the current scheme?
     What benefits do you see that the current HPID model 
provides? Does it meet those needs?
     What challenges do you see with the current HPID model?
     What recommendations do you have going forward regarding 
health plan identifiers and the HPID final rule?
    At the May 3, 2017 NCVHS hearing, testimony was consistent with 
that from the February and June 2014 hearings and the May 2015 RFI. 
Health plans, providers, self-funded/Employee Retirement Income 
Security Act (ERISA) plans, clearinghouses, and vendors confirmed that 
the HPID did not satisfy a business need, did not provide other value, 
and its implementation would be costly and disruptive.
    Furthermore, industry indicated that it wished to continue using 
the Payer IDs instead of the HPID, and health plans and providers 
testified consistently that, even if required to use the HPID, they 
would not give up use of the Payer IDs. Importantly, as had been 
indicated in 2014 and 2015, multiple testifiers in 2017 reiterated that 
the health plan is the HIPAA covered entity that establishes the 
payment policies, but the payer is the entity that needs to be 
identified in the transactions. Organizations had evaluated the HPID 
policy and determined they could not use the HPID. Testifiers stated 
that it would be too confusing to make the change to using the HPID 
because it is not clear which of the components--CHP, SHP or OEID--
should be used in HIPAA transactions in place of the Payer IDs. One 
testifier noted that if none of those entities is the payer, the 
transaction routing process will be disrupted. Furthermore, testifiers 
were concerned about the cost to map Payer IDs to HPIDs without knowing 
how many HPIDs an entity has obtained, especially across the many 
systems and organizations involved. Stakeholders informed HHS that 
mapping would be a complex endeavor that would impact all parties. 
Mapping could be made more difficult by the potential for other changes 
in the edits and rules that would be required for reporting, provider 
enrollment, payer distribution, rerouting, and other related tasks.

[[Page 65122]]

    The May 2017 hearing provided additional confirmation of what HHS 
was previously told by health plan and provider testifiers in hearings. 
Moreover, those same testifiers were beginning to experience a positive 
return on investment due to use of the CAQH CORE operating rules 
adopted in July 2011. Both health plan and provider testifiers 
explained that operating rules supporting the eligibility and health 
care claim status transactions drive down the cost of using the HIPAA 
transactions--communication is faster, the contents of the transactions 
are more predictable, and the information more reliable. Based on 
industry testimony, use of Payer IDs in these transactions also appears 
to facilitate the provision of needed health plan information.
    Overall, there was near unanimity from testifiers that HHS should 
rescind the HPID and OEID. The oral and written testimony can be found 
on the NCVHS website at https://www.ncvhs.hhs.gov/meeting-calendar/agenda-of-the-may-3-2017-ncvhs-subcommittee-on-standards-hearing-on-health-plan-identifier-hpid/.
    In a June 21, 2017 letter to the Secretary,\4\ the NCVHS wrote that 
testifiers were unanimous regarding their preferred use of Payer IDs 
versus the HPID. The net of all the testimony was that while Payer IDs 
do not identify the health plan, they identify the payers, which is 
necessary to meet transaction routing needs. The NCVHS wrote that they 
heard from testifiers that the HPID interferes with the established 
processes and provides no value to industry. The NCVHS made three 
recommendations to HHS in this letter:
---------------------------------------------------------------------------

    \4\ June 21, 2017 NCVHS Letter to Secretary Price from May 3, 
2017 Hearing on the HPID.
---------------------------------------------------------------------------

     HHS should rescind its September 2012 final rule which 
required health plans to obtain and use the HPID.
     HHS should communicate its intent to rescind the HPID 
final rule to all affected industry stakeholders as soon as a decision 
is made. HHS should provide the applicable guidance on the effect a 
rescission may have on all parties involved.
     HHS should continue with the 2014 HPID enforcement 
discretion until publication of a final regulation rescinding the HPID 
final rule.
    For a full discussion of the key topics and recommendations from 
all of the NCVHS hearings from 2010 through 2017, we refer readers to 
the text of the documents on the NCVHS website: https://www.ncvhs.hhs.gov/subcommittees-work-groups/subcommittee-on-standards/.
    Industry has provided substantial input to the NCVHS and HHS 
regarding the use of identifiers, the terminology surrounding 
identifiers, and routing of standard transactions. We acknowledge that 
we envisioned the HPID as being foundational to other industry uses in 
the future, though we did not specifically describe these uses in the 
September 2012 final rule. Given the uncertainty and confusion about 
the HPID framework and enumeration, we believe it would be useful to 
reassess any future standard health plan identifier with additional 
input from industry. Several testifiers stated that any use case for a 
health plan identifier should be clearly defined in advance, and that 
ample opportunity for public comment be made available, and we agree 
that public input has often been useful for assessing complex concepts. 
We will consider options for industry engagement in the future.
    The OEID was intended to identify entities that are not health 
plans, health care providers, or individuals. As specified in 45 CFR 
162.514, these other entities are not required to obtain an OEID, but 
may obtain one if they need to be identified in covered transactions. 
During the outreach period in 2013, covered entities submitted 
questions about the enumeration, purpose, and use of the OEID. 
Commenters asked about its value in their responses to the 2015 RFI. In 
general, the industry continued to seek greater specificity and 
definitive information about uses for the OEID.
    To date, a total of 99 OEIDs have been assigned. None of the 
industry surveys conducted to date have collected data on the use of 
the OEID in HIPAA transactions, and none of the testifiers or 
commenters requested that it be retained for future use.

III. Provisions of the Proposed Regulations

    As noted previously, the HPID and OEID were adopted in the 
September 2012 final rule under the statutory authority of HIPAA and 
the Affordable Care Act. However, as we describe in this section of 
this proposed rule, we now believe, based on recommendations from the 
NCVHS and overwhelming and persistent industry input, the HPID and OEID 
do not, and cannot, serve the purpose for which they were adopted. 
Therefore, this rule proposes to remove Subpart E--Standard Unique 
Health Identifier for Health Plans at 45 CFR 162, as well as the 
definitions of ``Controlling health plan'' (CHP) and ``Subhealth plan'' 
(SHP) at 45 CFR 162.103.
    Two primary areas of industry concern emerged from the May 2015 
RFI. These concerns were emphatically repeated in all the post-final 
rule industry feedback, through direct inquiries to HHS and NCVHS 
hearings testimony and recommendations. Industry has developed best 
practices for use of Payer IDs for purposes of conducting the HIPAA 
transactions. The adopted HPID does not have a place in these 
transactions, and from industry's perspective, does not facilitate 
administrative simplification.
    We now better understand the significance of providers being able 
to identify the payer in a HIPAA transaction. The provider needs to 
know which organization should receive an inquiry about a patient's 
eligibility for services, or which entity will receive the health care 
claim transactions. The organization that needs to be identified in 
transactions is the payer, rather than the health plan. Industry has 
clearly communicated that they are successfully routing transactions 
using the various Payer IDs, and cannot use the HPID. Payers often 
contract with many health plans or own a network of health plans which 
operate in different geographic regions. In their letters and 
testimony, payers maintained that the process of determining how to 
designate and enumerate the health plans as CHPs or SHPs was a 
significant challenge. Many organizations were concerned about being 
able to accurately conduct what they deemed a complicated analysis to 
determine corporate entity ownership and organizational relationships, 
and make the right decisions about enumeration. According to health 
care providers, their information exchange systems are programmed to 
identify the payers in the transactions, not the individual health 
plan. Once enumeration was complete, neither the payers nor the 
providers were confident that the mapping would be accurate. Regardless 
of the enumeration, according to testimony and comments, requiring 
covered entities to use the HPID in HIPAA transactions would not have 
addressed any remaining routing challenges, provided information about 
the services covered under a health plan's benefit package, or allowed 
for a higher level of automation for health care provider offices, 
particularly for provider processing of billing and insurance-related 
tasks, eligibility responses from health plans, and remittance advice 
that describes health care claim payments.
    Likewise, when we adopted the OEID, we believed that because 
entities other than health plans were identified in

[[Page 65123]]

HIPAA transactions in a similar manner as health plans, establishing 
the OEID would increase efficiency. The few comments we received on the 
OEID in any forum have led us to believe that the identifier is not 
useful or necessary, and that the fields where the OEID would go in the 
HIPAA transactions can be successfully populated using other numbers 
such as the TIN, EIN, or North American Industry Classification System 
code from the NAIC. Similar to the HPID, we now understand that 
providing another data element for other entities does not add value 
for industry's business processes.
    Second, it would be a costly, complicated, and burdensome 
disruption for the industry to have to implement the HPID because it 
would require mapping existing Payer IDs to HPIDs. This process was 
perceived as complicated, with the potential for wide-scale misrouting 
of claims and other transactions.
    We also believe it is appropriate to remove the definitions of 
controlling health plan (CHP) and subhealth plan (SHP) at 45 CFR 
162.103. Those terms were established in the September 2012 final rule 
in association with the HPID requirements. Because the two terms are 
integrally related to the HPID requirements, we believe they would have 
no application if we finalize our proposal to rescind the HPID.
    Finally, should we finalize this proposal to rescind the HPID and 
OEID, rather than having each entity deactivate their HPIDs and OEIDs, 
we are proposing that we would deactivate each HPID and OEID record in 
the Health Plan and Other Entity Enumeration System (HPOES) on behalf 
of each enumerated entity, and notify the manager of record at the 
current email address in the system. We propose that HHS would store 
the numbers for 7 years in accordance with federal record keeping 
requirements and that HHS would not regulate any actions entities may 
take with their existing HPID identifiers or their use. We propose that 
entities that acquired HPIDs and OEIDs would be free to retain and use 
these identifiers at their own discretion.
    There are two legislative enactments that require us to adopt a 
standard unique health plan identifier, and in this proposed rule we 
have provided a history of our efforts to do so. We will continue to 
work with industry on other solutions to meet those requirements, and 
we remain open to industry and NCVHS discussion and recommendations for 
an appropriate use case that might eliminate or reduce costs and burden 
on covered entities.
    We welcome comments on these proposals.

IV. Collection of Information Requirements

    This document does not impose information collection requirements, 
that is, reporting, recordkeeping or third-party disclosure 
requirements. Consequently, there is no need for review by the Office 
of Management and Budget under the authority of the Paperwork Reduction 
Act of 1995 (PRA) (44 U.S.C. 3501 et seq.).
    However, it must be noted that the information collection request 
(ICR) associated with the HPID was previously approved under OMB 
control number 0938-1166 and subsequently expired May 31, 2016. HHS 
incurred a violation of the PRA when the ICR expired. As stated earlier 
in this document, we are proposing to rescind the adoption of the HPID 
and the other entity identifier (OEID) along with the implementation 
specifications and requirements for the use of the HPID and OEID; 
therefore, we will not be seeking to reinstate the ICR previously 
approved under 0938-1166.

V. Response to Comments

    Because of the large number of public comments we normally receive 
on Federal Register documents, we are not able to acknowledge or 
respond to them individually. We will consider all comments we receive 
by the date and time specified in the DATES section of this preamble; 
and when we proceed with a subsequent document, we will respond to the 
comments in the preamble to that document.

VI. Regulatory Impact Statement

    We have examined the impact of this rule as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993), 
Executive Order 13563 on Improving Regulation and Regulatory Review 
(January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 
1980, Pub. L. 96-354), section 1102(b) of the Act, section 202 of the 
Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104-4), 
Executive Order 13132 on Federalism (August 4, 1999), the Congressional 
Review Act (5 U.S.C. 804(2)), and Executive Order 13771 on Reducing 
Regulation and Controlling Regulatory Costs (January 30, 2017).
    Executive Orders 12866 and 13563 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). A 
Regulatory Impact Analysis (RIA) must be prepared for major rules with 
economically significant effects ($100 million or more in any 1 year). 
This rule does not reach the economic threshold and thus is not 
considered a major rule, thus we are not required to prepare an RIA. We 
discuss our approach to Executive Order 12866 and demonstrate that this 
rule would not have economically significant effects because it would 
not only remove requirements perceived by industry as burdensome, but 
it would rescind a regulation that has effectively never been 
implemented by industry. We have described in detail the history and 
impact in the preamble, and provide more information later in this 
section.
    The RFA requires agencies to analyze options for regulatory relief 
of small entities. For purposes of the RFA, small entities include 
small businesses, nonprofit organizations, and small governmental 
jurisdictions. Most hospitals and most other providers and suppliers 
are small entities, either by nonprofit status or by having revenues of 
less than $7.5 million to $38.5 million in any 1 year. Individuals and 
states are not included in the definition of a small entity. We are not 
preparing an analysis for the RFA because we have determined, and the 
Secretary certifies, that this proposed rule would not have a 
significant economic impact on a substantial number of small entities.
    In addition, section 1102(b) of the Act requires us to prepare an 
RIA if a rule may have a significant impact on the operations of a 
substantial number of small rural hospitals. This analysis must conform 
to the provisions of section 603 of the RFA. For purposes of section 
1102(b) of the Act, we define a small rural hospital as a hospital that 
is located outside of a Metropolitan Statistical Area for Medicare 
payment regulations and has fewer than 100 beds. We are not preparing 
an analysis for section 1102(b) of the Act because we have determined, 
and the Secretary certifies, that this proposed rule would not have a 
significant impact on the operations of a substantial number of small 
rural hospitals.
    Section 202 of the Unfunded Mandates Reform Act of 1995 also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. In 2018, that 
threshold is approximately $150 million. This rule would have no 
consequential effect on state, local, or

[[Page 65124]]

tribal governments or on the private sector.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a proposed rule (and subsequent 
final rule) that imposes substantial direct requirement costs on state 
and local governments, preempts state law, or otherwise has Federalism 
implications. Since this regulation does not impose any costs on state 
or local governments, the requirements of Executive Order 13132 are not 
applicable.
    Executive Order 13771, titled Reducing Regulation and Controlling 
Regulatory Costs, was issued on January 30, 2017, and requires that the 
costs associated with significant new regulations ``shall, to the 
extent permitted by law, be offset by the elimination of existing costs 
associated with at least two prior regulations.'' This proposed rule is 
expected to be an E.O. 13771 deregulatory action. Details on the 
estimated cost savings of this proposed rule can be found in the rule's 
economic analysis.

A. Cost and Savings

    As stated previously, and shown in this section, we estimate that 
this proposed rule would not have economically significant effects on 
industry. We refer readers to the September 2012 final rule where we 
made several references to the large measure of uncertainty in the 
assumptions of our original impact analysis. In some cases we indicated 
that the HPID would be ``foundational'' to subsequent activities such 
as the automation of the Coordination of Benefits (COB) process (77 FR 
54705). We also stated that the costs and benefits associated with the 
HPID were applicable only to entities that are directly involved in 
sending or receiving HIPAA transactions and that the cost estimates 
were based on the number of health plans that would use the HPID in the 
transactions, though we did not have data on how many health plans were 
actually identified in HIPAA transactions, as opposed to ``other 
entities'' that were, instead, identified in HIPAA transactions (77 FR 
54703). Therefore, we said that we had no assurance of how many health 
plans would use the HPID in standard transactions, and took a 
conservative approach to the costs to health plans. We were aware that 
covered entities were using Payer IDs to identify the health plan or 
the responsible entity in transactions. Though a few commenters did not 
agree with the methodology we chose for our cost analysis in the 
proposed rule, we did not change it in the September 2012 final rule.
    For the estimated cost and benefits of implementation and use of 
HPID, we reiterate the narrative from the April 2012 proposed rule: The 
discussion needs to be understood in the context of the initial belief 
that the HPID would be foundational to other administrative 
simplification initiatives, both those initiated by industry and those 
regulated by State or Federal governments. In the proposed and final 
rules published in 2012, we suggested that if other initiatives did not 
follow, then the HPID would likely have little substantive impact (77 
FR 22977). Since we essentially imposed a delay on implementing the 
HPID through the enforcement discretion, its use has not had an impact 
on other administrative simplification initiatives. Rather, industry 
has made its own operational improvements by other means.
    In the April 2012 proposed rule, we stated that the possible cost 
and benefit impacts are reflective of the uncertainty inherent in the 
health care industry. However, to illustrate the foundational aspects 
of the HPID, we estimated an increase in the use of two transactions, 
eligibility for a health plan and health care claim status, in the 
range of 1 to 2 percent per year, for 10 years, starting in 2015. The 
increase could be attributable to the implementation of the HPID (77 FR 
22977). We also estimated a 1 to 3 percent increase in the use of the 
electronic health care payment and remittance advice transaction 
attributable to implementation of the HPID because the routing of that 
transaction is especially important for the payment process. Yet, 
despite HPID compliance having been under enforcement discretion, all 
three of these transactions have seen modest increases in use. Thus, 
our assumption that an increase in the use of those transactions could 
be attributed to the HPID was incorrect. As we have explained elsewhere 
in this proposed rule, some of the increases (and therefore savings) 
may be due to use of the adopted operating rules and some may be due to 
improved system capabilities. CAQH conducts a study each year to assess 
the utilization of the transactions and operating rules, and tries to 
identify savings opportunities from their use. The most recent report 
from 2016 shows progressive adoption of the eligibility for a health 
plan, health care claim status, and health care electronic funds 
transfers (EFT) and remittance advice transactions. The transactions 
use Payer IDs for routing and other payer and health plan 
identification purposes. We acknowledge that while this study only 
includes those payers, plans, and providers that participated, it is 
nonetheless indicative of a positive trend in the utilization rate 
without use of the HPID. Table 1 shows the steady increase in 
industry's use of three transactions over a period of 4 years, which 
includes 2 years where HPID rule was in effect but compliance action 
was not taken due to the ongoing enforcement discretion.

                Table 1--CAQH Study Participant Adoption Rate of Certain Standard Transactions *
----------------------------------------------------------------------------------------------------------------
                                              Claim status (fully
                                                  electronic)          Eligibility (%)     Remittance advice (%)
----------------------------------------------------------------------------------------------------------------
2012.......................................                    48                     65                     NA
2013.......................................                    50                     65                     NA
2014.......................................                    57                     71                     51
2015.......................................                    63                     76                     55
----------------------------------------------------------------------------------------------------------------
* CAQH 2016 Efficiency Index https://www.caqh.org/explorations/2016-caqh-index-report.

    We do not attempt to attribute other cost savings to this proposed 
rule because we do not have industry data regarding expenditures, if 
any, for anticipated system implementation and transition costs such as 
software and software development, testing, training, and other 
conversion costs. To the best of our knowledge, expenditures have not 
been made to prepare for use of the HPID during the enforcement 
discretion period, nor have new contracts been executed for the 
services of software system vendors, billing companies, transaction 
vendors, and/or health care clearinghouses to facilitate the transition 
to the HPID. We invite industry comment on our assumptions.

[[Page 65125]]

1. Costs
    Certain funds have already been expended and cannot be recouped by 
the federal government and by those organizations that have already 
applied for and obtained an HPID or OEID. The federal government spent 
$1.5 million to build the components of the enumeration system specific 
to the HPID and OEID, and currently spends $45,000 annually for 
operations and maintenance. We cannot account for the cost of legal 
personnel that may have been expended in conducting the analysis for 
the number or type of HPIDs or OEIDs that may have been acquired.
2. Savings
    As a result of our proposal to rescind the HPID and OEID, we 
believe there would be modest cost avoidance (savings). First, we 
assume there will be no costs for enumeration of new health plans or 
other entities while the September 2012 final rule remains in effect 
due largely to the ongoing enforcement discretion, and because there is 
no growth in the number of overall health plans. We base this 
assumption on data from our April 2012 proposed rule, in which we 
reported that from 2013 to 2018, industry trends indicate that the 
number of health plans will remain constant, or even decrease.\5\ Our 
calculations reflected that there would be no statistically significant 
growth in the number of health plans or other entities and we 
calculated zero growth in new applications (77 FR 22971). We 
acknowledge that some of our assumptions in the April 2012 proposed 
rule may be outdated, and welcome industry feedback on our use of those 
assumptions for purposes of this analysis.
---------------------------------------------------------------------------

    \5\ See Robinson, James C., ``Consolidation and the 
Transformation of Competition in Health Insurance,'' Health Affairs, 
23, no.6 (2004):11-24; ``Private Health insurance: Research on 
Competition in the Insurance Industry,'' U.S. Government 
Accountability Office (GAO), July 31, 2009 (GAO- 09-864R); American 
Medical Association, ``Competition in Health Insurance: A 
Comprehensive Study of US Markets,'' 2008 and 2009.
---------------------------------------------------------------------------

    In the April 2012 proposed rule, we estimated that there would be 
up to 15,000 entities that would be required to, or would elect to, 
obtain an HPID or OEID. We based this number on the data in Chart 2 
from the April 2012 proposed rule which is republished here for 
reference (77 FR 22970).

  Table 2--Number and Type of Entities That Were Expected To Obtain an
                              HPID or OEID
------------------------------------------------------------------------
                                                             Number of
                     Type of entity                          entities
------------------------------------------------------------------------
Self-insured group health plans, health insurance               * 12,000
 issuers, individual and group health markets, HMOs
 including companies offering Medicaid managed care.....
Medicare, Veterans Health Administration, Indian Health         ** 1,827
 Service................................................
TriCare and State Medicaid programs.....................              60
Clearinghouses and Transaction vendors..................         *** 162
Third Party Administrators..............................        **** 750
                                                         ---------------
    Total...............................................          15,000
------------------------------------------------------------------------
* Report to Congress: Annual Report on Self-Insured Group Health
  Plans,'' by Hilda L. Solis, Secretary of Labor, March 2011.
** Patient Protection and Affordable Care Act; Standards Related to
  Reinsurance, Risk Corridors, and Risk Adjustment, 2011 Federal
  Register (Vol. 76), July, 2011,'' referencing data from
  www.healthcare.gov.
*** Health Insurance Reform; Modifications to the Health Insurance
  Portability and Accountability Act (HIPAA) Electronic Transaction
  Standards; Proposed Rule https://edocket.access.gpo.gov/2008/pdf/E8-19296.pdf, based on a study by Gartner.
**** Summary of Benefits and Coverage and the Uniform Glossary; Notice
  of Proposed Rulemaking https://www.gpo.gov/fdsys/pkg/FR-2011-08-22/pdf/2011-21193.pdf.

    As we stated earlier in this proposed rule, slightly fewer than 
11,000 entities applied for and obtained an HPID immediately following 
publication of the September 2012 final rule. The cost for enumeration 
was explained in the April 2012 proposed rule (77 FR 22970). Health 
plans and other entities were required to complete the application or 
update form online through the Health Plan and Other Entity Enumeration 
System (HPOES). Any changes to a health plan's information are 
submitted to the same system. Most applications were received shortly 
after publication of the September 2012 final rule, subsequent to which 
the application rate slowed down considerably. Between May 2016 and May 
2017, 156 applications for HPIDs were received.
    The HPID and OEID application is a one-time burden, and our cost 
savings estimate for this proposed rule is based on the elimination of 
that burden. For purposes of this impact analysis, we make an estimate 
of the elimination of that burden. We have proposed a method to help 
industry implement this proposal in a cost effective way if it is 
finalized, by HHS deactivating the HPIDs and OEIDs. The cost savings 
are estimated as follows: We estimated that it would take 30 minutes to 
complete the on-line application form or make updates, and used an 
hourly labor rate of approximately $23/hour, the average wage reported 
for professional and business services sector, based on data from the 
Department of Labor, Bureau of Labor Statistics, June 2011, ``Average 
hourly and weekly earnings of production and nonsupervisory employees 
(1) on private nonfarm payrolls.'' (https://www.bls.gov/news.release/empsit.t24.htm). If we increase the rate to account for 2017 dollar 
values (March 2017 table), to $31/hour, this represents a unit cost of 
$15.00 per HPID or OEID application. For the initial enumeration of 
11,000 entities, this would have been $165,000.
    Rather than having each entity individually deactivate their HPIDs 
and OEIDs if this proposed rule is finalized, HHS is proposing that it 
would deactivate each HPID and OEID record in the HPOES and notify the 
manager of record at the current email address available in the system. 
The HPIDs and OEIDs would be stored securely in the HHS record system 
for 7 years. There would be no further cost to the enumerated entities. 
We believe that the cost to HHS will not be substantial for this task 
because it will be conducted as part of regular staff activities.
    We also estimated the potential savings for those entities that 
might have already updated their HPID or OEID records before the HHS 
deactivation and based our assumption on the actual number of updates 
to the HPOES system since 2013. Each year, an average of 95 records, or 
1 percent of

[[Page 65126]]

valid applications have been deactivated or updated. Using the same 
formula, if 1 percent of the current organizations (110 entities) 
update their HPIDs/OEIDs, the cost would be $1,650 (110 x $15). To 
account for any increase in wages and benefits, we multiply this by two 
(2), and arrive at a sum of $3,300. This proposed rule might result in 
savings of $3,300 if finalized. We typically provide ranges in an 
impact analysis, and so provide a high range of 3 percent as well. 
Therefore, our calculation means 330 entities would make updates, for a 
total high end savings estimate of $9,900 (330 x $15) x 2. However, 
should this proposed rule be finalized, those updates would not be 
necessary and organizations that have obtained HPIDs or OEIDs would not 
need to take any action. See Table 3 for a summary of the savings for 
updates that would not have to be made to HPIDs and OEIDs after 2019.
    We welcome industry feedback on our assumptions, estimates, and the 
deactivation of the HPID and OEIDs.
3. Summary of Costs and Savings for the Proposal To Rescind the HPID

                         Table 3--Savings (Cost Avoidance)--Updates That Would not Have To Be Made to HPIDs and OEIDs After 2019
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                               2019
                       Savings                        ----------------------    2020       2021       2022       2023       2024       2025       2026
                                                           1%         3%
--------------------------------------------------------------------------------------------------------------------------------------------------------
Updates to enumeration...............................     $3,300     $9,900         $0         $0         $0         $0         $0         $0         $0
    Total............................................      3,300      9,900
--------------------------------------------------------------------------------------------------------------------------------------------------------

D. Regulatory Review Costs

    If regulations impose administrative costs on private entities, 
such as the time needed to read and interpret a proposed rule, we 
should estimate the cost associated with the review of our documents. 
We assume that commenters on this proposed rule will be representative 
of HIPAA covered entities and their business associates--primarily 
health plans, health care clearinghouses, health care providers and 
vendors. However, it is not possible to accurately quantify the number 
of entities, or the number of individuals within each organization who 
will participate in reviewing the proposed rule. Our best estimate is 
based on the number of organizations who have submitted comments on 
previous regulations related to HIPAA standards and operating rules, 
and organizations who have participated in NCVHS hearings. HHS has 
received comments from approximately 100 to 150 commenters on past 
HIPAA regulations, and there are a similar number of organizations who 
either testify or listen to the NCVHS hearings. We assume this number 
will hold true for this proposed rule. We acknowledge that this 
assumption may result in an understatement or overstatement of the cost 
calculation for the review of this proposed rule. We also recognize 
that this proposed rule will affect covered entities in different ways, 
however, both health plans and health care providers have provided 
feedback on this topic in the past, and may have a positive or negative 
response to the proposal. For purposes of our estimate we assume that 
each reviewer reads approximately 50 percent of the proposed rule. 
Using the wage information from the BLS for Computer and Information 
Systems managers for insurance carriers (Code 11-3021), we estimate 
that the cost of reviewing the proposed rule is $70.07 per hour, 
including overhead and fringe benefits (https://www.bls.gov/oes/current/oes113021.htm). Assuming an average reading speed, we estimate 
that it will take approximately 2.5 hours for these individuals to 
review half of the proposed rule. We estimate that multiple individuals 
from 150 organizations will read the proposed rule, and that the key 
readers are likely the information systems manager and legal staff. We 
selected the information systems manager for purposes of this analysis. 
For each information systems manager that reviews the rule, the 
estimated cost is $175.17 (2.5 hours x $70.7). Therefore, we estimate 
that the total cost of reviewing this proposed rule is $175 x 150 
reviewers = $26,250. Though we acknowledge that our estimate for the 
total number of reviewers may be high, we are trying to provide an 
estimate for the burden of reviewing our proposal and welcome feedback 
if appropriate.

E. Alternatives Considered

    We are not required to provide alternatives for our proposal 
because we are not providing a full regulatory impact analysis, and we 
have fully discussed our reasons for proposing to rescind the HPID and 
OEID throughout this proposed rule. However, we did