Administrative Simplification: Rescinding the Adoption of the Standard Unique Health Plan Identifier and Other Entity Identifier, 57621-57629 [2019-23507]

Agencies

• DEPARTMENT OF HEALTH AND HUMAN SERVICES
• Office of the Secretary

[Federal Register Volume 84, Number 208 (Monday, October 28, 2019)]
[Rules and Regulations]
[Pages 57621-57629]
From the Federal Register Online via the Government Publishing Office [www.gpo.gov]
[FR Doc No: 2019-23507]


=======================================================================
-----------------------------------------------------------------------

DEPARTMENT OF HEALTH AND HUMAN SERVICES

Office of the Secretary

45 CFR Part 162

[CMS-0054-F]
RIN 0938-AT42


Administrative Simplification: Rescinding the Adoption of the 
Standard Unique Health Plan Identifier and Other Entity Identifier

AGENCY: Office of the Secretary, HHS.

ACTION: Final rule.

-----------------------------------------------------------------------

SUMMARY: This final rule rescinds the adopted standard unique health 
plan identifier (HPID) and the implementation specifications and 
requirements for its use and the other entity identifier (OEID) and 
implementation specifications for its use. This final rule also removes 
the definitions for the ``Controlling health plan'' (CHP) and 
``Subhealth plan'' (SHP).

DATES: This final rule is effective on December 27, 2019.

FOR FURTHER INFORMATION CONTACT: Lorraine Doo, (410) 786-6597 or 
[email protected].
    Brian James, (301) 492-4234 or [email protected] for 
questions regarding the Health Plan and Other Entity Enumeration System 
(HPOES).

SUPPLEMENTARY INFORMATION: 

I. Background

    Section 262 of the Health Insurance Portability and Accountability 
Act of 1996 (HIPAA) (Pub. L. 104-191) added section 1173 to the Social 
Security Act (the Act), which requires that the Secretary of the 
Department of Health and Human Services (HHS or the Secretary) adopt a 
standard unique health plan identifier.
    Congress renewed the requirement for the Secretary to adopt a 
standard unique

[[Page 57622]]

health plan identifier in section 1104(c)(1) of the Patient Protection 
and Affordable Care Act (Pub. L. 111-148) (as amended by the Health 
Care and Education Reconciliation Act of 2010 (Pub. L. 111-152) and 
collectively known as the Affordable Care Act or ACA) by requiring the 
Secretary to promulgate a final rule to establish a unique health plan 
identifier, as described in section 1173(b) of the Act and based on the 
input of the National Committee on Vital and Health Statistics (NCVHS), 
no later than October 1, 2012.
    In compliance with that Affordable Care Act requirement, in the 
September 5, 2012 Federal Register (77 FR 54664), we published a final 
rule titled ``Administrative Simplification: Adoption of a Standard for 
a Unique Health Plan Identifier; Addition to the National Provider 
Identifier Requirements; and a Change to the Compliance Date for the 
International Classification of Diseases, 10th Edition (ICD-10-CM and 
ICD-10-PCS) Medical Data Code Sets'' (hereafter referred to as the 
September 2012 final rule). The September 2012 final rule adopted a 
standard unique health identifier for health plans (the HPID) and an 
``other entity identifier'' (the OEID) for an entity that is not a 
health plan, individual, or health care provider, but that needs to be 
identified in a HIPAA transaction. Entities that qualified for an OEID 
were not required to obtain or use that identifier.
    Soon after publication of the September 2012 final rule, industry 
stakeholders, in particular, health plans, identified a number of 
implementation challenges with the policy. Health plans and their 
provider trading partners provided substantial input to HHS and the 
NCVHS about barriers to implementation of the HPID. Stakeholders 
informed HHS that the HPID was not needed for routing HIPAA 
transactions nor did it provide information about health plan products 
and benefits. Further, they stated it would not reduce the cost of 
managing financial and administrative information, and that if they 
were to implement the HPID, it would impose significant costs instead 
of decreasing them. Stakeholders also indicated that the OEID had 
minimal value and stated they were confused about the enumeration, 
purpose, and use of the OEID. Since 2014, only 99 organizations have 
applied for and received OEIDs.
    Based on industry's concerns about the September 2012 final rule, 
HHS issued a statement of enforcement discretion in October 2014,\1\ 
which delayed enforcement of the requirements pertaining to HPID 
enumeration and use of the HPID in the HIPAA transactions. Enforcement 
discretion meant that HHS would not impose penalties if it determined a 
covered entity was out of compliance with the September 2012 final 
rule. Between 2014 and 2018, HHS continued to receive input from 
stakeholders and from the NCVHS, requesting that the regulatory mandate 
for the HPID be removed.
---------------------------------------------------------------------------

    \1\ Statement of Enforcement Discretion regarding 45 CFR 162 
Subpart E--Standard Unique Health Identifier for Health Plans 
https://www.cms.gov/Regulations-and-Guidance/Administrative-Simplification/Unique-Identifier/HPID.html.
---------------------------------------------------------------------------

    In the December 19, 2018 Federal Register (83 FR 65118), we 
published a proposed rule titled ``Administrative Simplification: 
Rescinding the Adoption of the Standard Unique Health Plan Identifier 
and Other Entity Identifier'' (hereafter referred to as the December 
2018 proposed rule). There, we provided an overview of the HPID 
history, and described industry testimony and recommendations to the 
NCVHS and the NCVHS's recommendations to us about the HPID. We included 
specific information from stakeholders to the NCVHS that the HIPD and 
OEID did not, and could not, serve the purposes for which they had been 
adopted. In addition, we included the NCVHS's September 23, 2014 
recommendation to us that the HIPD not be used in administrative 
transactions. We also committed to exploring options for a more 
effective standard unique health plan identifier in the future, and 
with respect to which we would collaborate with stakeholders in an open 
process (83 FR 65122). For more detailed information about the industry 
response to the adoption of the HPID and OEID and the NCVHS's 
recommendations to us, see the December 2018 proposed rule (83 FR 65119 
through 65122).

II. Provisions of the Proposed Rule and the Analysis of and Responses 
to Public Comments

    As stated previously, the HPID and OEID were adopted in the 
September 2012 final rule under the statutory authorities of HIPAA and 
the Affordable Care Act. In the December 2018 proposed rule, we 
described how we came to understand, based on recommendations from the 
NCVHS and overwhelming industry input, that the HPID and OEID do not 
meet the need for which they were adopted. Therefore, we proposed to 
remove Subpart E--Standard Unique Health Identifier for Health Plans at 
45 CFR part 162. We also proposed to remove the definitions of 
``Controlling health plan'' (CHP) and ``Subhealth plan'' (SHP) at 45 
CFR 162.103 as those terms are integrally related to the HPID 
requirements, without which they would have no application (83 FR 
65123).
    Finally, we proposed that if we finalized our proposal to rescind 
the HPID and OEID, we would deactivate each HPID and OEID record in the 
Health Plan and Other Entity Enumeration System (HPOES) on behalf of 
each enumerated entity, as opposed to each entity having to do so 
itself, and would notify the manager of record at the current email 
address in the system (83 FR 65123). In addition, we proposed to store 
the identifiers for 7 years in accordance with federal recordkeeping 
requirements, and proposed that we would not regulate any actions 
entities may take with their existing HPID and OEID identifiers, such 
that they would be free to retain and use these identifiers at their 
own discretion (83 FR 65123). We welcomed comments on all of our 
proposals.
    In response to the December 2018 proposed rule, we received 19 
pieces of timely correspondence from major associations representing 
health plans, self-funded group employer plans, and providers, as well 
as from large vendors and other individual organizations. All of the 
timely submissions supported our proposal to rescind the HPID and OEID 
and remove the definitions of CHP and SHP, while the late commenter 
opposed our proposal to rescind the identifiers. Several commenters 
supported our proposal that we deactivate the identifiers on behalf of 
the entities that had obtained them. Most of the commenters thanked us 
for our proposal to rescind the HPID and OEID and for HHS's continued 
efforts to reduce administrative burden on clinicians so they can focus 
on providing patient care.
    Commenters' main points included the following:
     A preference for use of Payer IDs.
     No need for, or value in, the HPID.
     Reducing the burden on self-funded groups or health plans.
     The cost of implementing the HPID.
     Communications about the deactivation of the HPIDs/OEIDs.
     The importance of industry engagement in any future 
discussions about appropriate business or use cases for a standard 
health plan identifier.
    A summary of the public comments received, and our responses 
follow.

[[Page 57623]]

A. Use of the HPID vs. Payer IDs

    In the December 2018 proposed rule, we provided an overview of 
stakeholder feedback regarding adoption of the HPID, explaining that 
the industry had developed best practices for the use of Payer IDs, 
which are non-HIPAA-based industry-derived identifiers, for purposes of 
conducting the HIPAA transactions, and that the HPID did not have a 
place in these transactions (83 FR 65122). We explained that 
stakeholders stated that the organizations that need to be identified 
in HIPAA transactions are the payers rather than the health plans, and 
that industry is successfully routing transactions using the Payer IDs 
and could not use the HPID to do so (83 FR 65122).
    Comment: Several commenters stated that they appreciated HHS 
acknowledging the distinction between the HPID and Payer IDs, the 
industry's use of, and reliance on, Payer IDs in the HIPAA 
transactions, and the impact of having to accommodate a new identifier. 
A commenter noted that Payer IDs are the common denominator for payers, 
physicians, and the patients they serve, that permit entities to 
communicate effectively using HIPAA electronic transactions such as 
claims, eligibility, claim status, and enrollment. Another commenter 
wrote that, in general, the need for a health plan identifier changed 
between the enactment of HIPAA and HHS's adoption of the HPID. As 
industry gained experience with the transaction standards adopted under 
HIPAA, it was able to resolve, via Payer IDs, the issue of identifying 
the payer for routing transactions. Commenters explained that, at this 
point, the HPID would have been an impediment to the effective use of 
the HIPAA transactions. One large provider group wrote that, while the 
HPID had been intended to solve routing issues identified at the time 
HIPAA was enacted in 1996, in today's environment, using the Payer IDs, 
providers no longer experienced routing issues. This group further 
noted that expending resources on implementing the HPID would be 
wasteful and would hurt the industry, including providers, vendors, 
clearinghouses, and payers.
    Response: We have acknowledged that industry is effectively using 
Payer IDs to route and exchange the HIPAA transactions, and appreciate 
the confirmation from commenters. This final rule rescinds the HPID and 
the implementation specifications and requirements for its use.
    Comment: A commenter opposed the proposal to rescind the HPID, 
stating that removal of the identifiers would create more ambiguity for 
health care claims transactions and would obscure relationships between 
financially responsible entities. The commenter stressed the importance 
of a provider's ability to determine the entity that will be receiving 
eligibility requests and the entity that is financially responsible to 
remit payment for covered healthcare services.
    Response: We acknowledged in the December 2018 proposed rule that 
covered entities will need to know how each party to a transaction is 
identified and which parties are financially responsible or will be 
able to respond to the transactional inquiries. According to the input 
we received over the past several years from health plans and 
providers, Payer IDs adequately identify the entity that will receive 
the eligibility request, be financially responsible for the claim, and 
remit payment. Other commenters confirmed that Payer IDs are used 
successfully to route transactions for these specific purposes. Within 
these transactions, Payer IDs identify the payer that has 
responsibility for the information identified in this comment (that is, 
routing and receiving an eligibility request or bearing financial 
responsibility for a claim) and other relevant information needed by 
the receiver. Not only do the views of stakeholders and the 
recommendations from the NCVHS presented to us for several years 
consistently run counter to this commenter's views, we also note that, 
due to the continuing enforcement discretion, the HPID has not seen 
widespread implementation, thus we question how its rescission could 
create ambiguity or obscure the relationships between covered entities. 
Nevertheless, the commenter reminds us of the critical importance of 
maintaining an industry-wide perspective as we explore future 
rulemaking pertaining to the HIPAA transactions and a unique health 
plan identifier.
    Comment: A commenter opposed the rescission of the HPID on the 
basis that the HPID--(1) should be included in contractual arrangements 
between health plans, payers, and third-party service providers when 
these organizations act on behalf of self-funded employers; and (2) is 
important to identify the entity that has financial control or 
responsibility and to whom the provider may need to appeal for adverse 
benefit determinations.
    Response: We note that the health care system is complex, 
particularly with respect to the arrangements between self-funded 
employer groups, health plans, third-party administrators, and 
providers. The NCVHS hearings and other public forums have yielded no 
information supporting the use of the HPID by self-funded employer 
groups or their business associates, while, by contrast, self-funded 
employer groups have consistently opposed the use of HPID. In response 
to the December 2018 proposed rule, other commenters confirmed that use 
of the HPID would have increased costs not only to their members, but 
also to providers, and that the HPID would not have improved 
transactions or information exchange. Rather, they reiterated that 
continued use of Payer IDs by their business associates on their behalf 
was the appropriate and correct technical and business solution.

B. Use of the OEID

    We adopted the OEID because we believed that entities that were not 
health plans, but identified in HIPAA transactions in a manner similar 
to health plans, could use the OEID in HIPAA transactions, which we 
believed would increase standardization (77 FR 54665). Since 
publication of the September 2012 final rule, 99 OEIDs have been 
assigned in the HPOES. We do not have any information regarding actual 
use of the OEID in the HIPAA transactions.
    Comment: Several commenters stated that there was no value or 
efficiency gained from using the OEID if an organization provided one 
in a transaction. A few commenters strongly agreed with our proposal 
that the identifier was not necessary or useful; however, they did not 
provide specific details in their written comments.
    Response: We thank the commenters for their feedback. We also 
believe the low number of applications for OEIDs is an indicator that 
the OEID does not provide the intended value. We are finalizing our 
proposal to rescind the OEID as well.

C. Costs of the HPID

    Comment: Several commenters stated that the cost of implementing 
the HPID would have outweighed the benefits. Most of the commenters 
agreed that there was no return on investment for implementing the HPID 
because Payer IDs already serve the purpose of routing transactions. 
Some commenters reiterated what HHS stated in the December 2018 
proposed rule regarding the costs and burden of mapping the existing 
Payer IDs to HPIDs. Some of these commenters from self-funded employer 
groups stated that they do not perform most health care transactions, 
such as eligibility determinations, claims status, or EFT and 
remittance advice, but, rather, they engage third party administrators 
(TPAs) to do so on

[[Page 57624]]

their behalf. Therefore, compliance with the HPID final rule would have 
involved new administrative procedures and would have required 
extensive coordination with multiple TPAs, with the administrative and 
cost burden greatly outweighing any utility of the HPID.
    A few commenters praised the proposal and commented that, for large 
organizations with numerous subparts, the HPID enumeration burden was 
far greater and more complex than HHS had envisioned when the HPID was 
adopted. These commenters explained that the HPID enumeration was 
further complicated by confusion about the requirements for self-
funded, fully insured, and combination fully insured and self-funded 
groups. The commenters wrote that the policy resulted in high 
implementation cost projections that would have yielded little to no 
return on investment. The commenters believe that the traditional 
payers and TPAs supporting these groups would have incurred 
considerable cost that they likely would have passed on to the provider 
community had HPIDs been required in standard transactions. These 
commenters also confirmed that existing Payer IDs were sufficient to 
identify the payer and any other information needed to process HIPAA 
transactions.
    Response: We are confirming our cost/benefit analysis that the 
costs to implement the HPID outweigh the return on investment. We 
reiterate in the Regulatory Impact Analysis that certain assumptions we 
made in the estimates of the 2012 proposed and final rules may have 
been misplaced or did not come to fruition, and that other activities 
have provided cost savings benefits for industry. This final rule 
yields cost avoidance for covered entities.

D. Definitions

    We proposed to remove the definitions of controlling health plan 
(CHP) and subhealth plan (SHP) at 45 CFR 162.103 because those terms 
were established in association with, and were integrally related to, 
the HPID requirements and would no longer have application were the 
HPID and OEID rescinded.
    Comment: A few commenters supported the proposal to remove the 
definitions of CHP and SHP.
    Response: We thank the commenters for their support and are 
finalizing our proposal to remove the definitions.

E. Deactivation of HPIDs and OEIDs

    We proposed to deactivate each HPID and OEID record in the Health 
Plan and Other Entity Enumeration System (HPOES) on behalf of each 
enumerated entity, and to notify the manager of record at the current 
email address in the system. In addition, we proposed to store the 
numbers for 7 years and to permit entities with HPIDs and OEIDs to 
retain and use them at their own discretion, such that HHS would not 
regulate any actions entities take with these existing identifiers (83 
FR 65123).
    Comment: Several commenters supported HHS's proposed role in the 
deactivation of HPIDs and OEIDs. A commenter requested that HHS 
consider notifying all authorized users on file for each HPID and OEID 
in HPOES in the event the individual in our records may have left an 
entity or changed email addresses. Another commenter suggested that HHS 
publicly notify the industry upon completion of the deactivation of the 
identifiers.
    Response: We appreciate the support of our proposal to deactivate 
HPIDs and OEIDs on behalf of the entities who obtained them. We also 
agree that it is important to communicate effectively (widely 
broadcast) to the stakeholder community after we complete the 
deactivation process and thank the commenter for that suggestion.
    HIOS is the Health Insurance Oversight System--a secure HHS web-
based application that collects and stores information about health 
plans, insurance companies, and issuers for national programs. HPOES is 
a HIOS module that assigns and manages HPIDs and OEIDs. On or after the 
publication date of this final rule in the Federal Register, HHS will 
send an email notice to all active HIOS users explaining the 
deactivation of the HPIDs and OEIDs and the upcoming HPOES changes. We 
recognize that many HIOS users will not have enumerated for an HPID or 
OEID, but know it is likely that many personnel, roles, and 
organizational affiliations may have changed since entities enumerated 
(obtained their identifiers). Therefore, transmitting this information 
to all active HIOS users will ensure that our first communication 
regarding the HPID deactivation process reaches the greatest number of 
potentially affected entities and individuals. Through outreach to HIOS 
users, we believe the information about the pending HPID and OEID 
deactivation will most effectively reach appropriate individuals in 
each enumerated entity.
    On or after the effective date of the final rule, HHS will 
deactivate all HPIDs and OEIDs. The HPOES module will remain open for 
an additional 60 days after HPID and OEID deactivation for viewing by 
HPOES module users to enable entities to capture data about their HPID 
or OEID.
    On or after the effective date of the final rule, HHS will also do 
the following:
     Post a notice on the HPOES homepage and the Centers for 
Medicare & Medicaid Services (CMS) website indicating that the 
deactivation for HPIDs and OEIDs has occurred and that new HPID and 
OEID applications will no longer be accepted. The notices will provide 
contact information for a help desk and the HHS administrative 
simplification office email.
     Send an email to HPOES module users informing them that 
all HPID and OEID numbers have been deactivated and that the HPOES 
system will remain open for 60 days to view information.
     Update the CMS website with information about the HPID and 
OEID deactivation activities and timeline.
    Comment: A few commenters stated that, upon deactivation of the 
HPIDs and OEIDs within the HPOES, the infrastructure to support the 
numbers would be removed and any HPIDs and OEIDs remaining in use would 
be rogue numbers operating outside the framework for standard code sets 
and electronic transactions for which HIPAA was intended. These 
commenters requested that HHS consider terminating the use of the HPIDs 
and OEIDs at the same time as their deactivation. They also suggested 
that, if there is a need to continue using the HPIDs and OEIDs for a 
period of time, the cases for use be clearly defined. The commenters 
requested that HPIDs and OEIDs be excluded from use within standard 
electronic transactions after termination.
    Response: In the December 2018 proposed rule, we proposed that 
entities with HPIDs and OEIDs could retain and use these identifiers at 
their own discretion and that HHS would not regulate any actions 
entities take with their existing HPIDs and OEIDs (83 FR 65123). We 
appreciate the commenters' concerns regarding the need to define use 
cases for HPIDs and OEIDs after deactivation and agree that, to ensure 
the effectiveness of the HIPAA transactions and drive efficiency, 
trading partners should collaborate and agree upon the best identifiers 
for exchanging and routing transactions.
    We have no indication that entities are using the HPIDs for any 
other purposes at this time. We did not receive sufficient input to 
warrant developing additional policies regarding the use of deactivated 
HPIDs or OEIDs for other purposes once the HPOES module is closed, but 
we will monitor our administrative simplification email

[[Page 57625]]

box and the complaint system for any indications of issues.

F. Industry Input on a Possible Future Standard Unique Health 
Identifier for Health Plans

    In the proposed rule, we acknowledged there are statutory 
requirements that HHS adopt a standard unique health identifier for 
health plans, and that we look forward to future industry and NCVHS 
discussions of appropriate use or business cases regarding such an 
identifier that might reduce costs or burden on covered entities (83 FR 
65123).
    Comment: A commenter stated that, given the uncertainty and 
confusion about the HPID and its enumeration scheme, they strongly 
supported our proposal to engage industry and provide an opportunity 
for public input regarding any consideration of a future standard 
identifier for health plans. Another commenter echoed the concerns 
about the uncertainty of the HPID, and indicated that HIPAA requires 
HHS to take into account multiple uses for a health plan identifier and 
to specify the purposes for which such an identifier may be used. These 
commenters indicated that it would be very difficult to use one 
identifier for multiple business use cases if the use cases are not 
compatible. The commenters urged HHS to confer with stakeholders before 
considering future alternatives or proposing any future uses of an 
identifier, particularly if the identifier would be used for multiple 
purposes.
    Response: We appreciate the willingness of industry to engage on 
this topic of unique health plan identifiers in the future. We 
encourage stakeholders to continue considering business cases for a 
standard health plan identifier and to share those options with the 
Secretary or NCVHS.
    After review of the public comments received, we are finalizing our 
proposals to remove Subpart E--Standard Unique Health Identifier for 
Health Plans at 45 CFR part 162, as well as the definitions of 
``Controlling health plan'' (CHP) and ``Subhealth plan'' (SHP) at 45 
CFR part 162.103 without modification. In this final rule, we are also 
affirming that HHS will conduct the deactivation activities on behalf 
of the enumerated entities and communicate to affected organizations 
and stakeholders about the deactivation process.

III. Collection of Information Requirements

    This document does not impose information collection requirements, 
that is, reporting, recordkeeping or third-party disclosure 
requirements. Consequently, there is no need for review by the Office 
of Management and Budget under the authority of the Paperwork Reduction 
Act of 1995 (PRA) (44 U.S.C. 3501 et seq.).
    However, it must be noted that the information collection request 
(ICR) associated with the HPID was previously approved under OMB 
control number 0938-1166 and subsequently expired May 31, 2016. HHS 
incurred a violation of the PRA when the ICR expired. As stated earlier 
in this document, we proposed to rescind the adoption of the HPID and 
the other entity identifier (OEID) along with the implementation 
specifications and requirements for the use of the HPID and OEID; 
therefore, we are not seeking to reinstate the ICR previously approved 
under 0938-1166.

IV. Regulatory Impact Statement

    We have examined the impact of this rule as required by Executive 
Order 12866 on Regulatory Planning and Review (September 30, 1993), 
Executive Order 13563 on Improving Regulation and Regulatory Review 
(January 18, 2011), the Regulatory Flexibility Act (RFA) (September 19, 
1980, Pub. L. 96-354), section 1102(b) of the Act, section 202 of the 
Unfunded Mandates Reform Act of 1995 (March 22, 1995; Pub. L. 104-4), 
Executive Order 13132 on Federalism (August 4, 1999), the Congressional 
Review Act (5 U.S.C. 804(2)), and Executive Order 13771 on Reducing 
Regulation and Controlling Regulatory Costs (January 30, 2017).
    Executive Orders 12866 and 13563 direct agencies to assess all 
costs and benefits of available regulatory alternatives and, if 
regulation is necessary, to select regulatory approaches that maximize 
net benefits (including potential economic, environmental, public 
health and safety effects, distributive impacts, and equity). A 
Regulatory Impact Analysis (RIA) is prepared for major rules with 
economically significant effects ($100 million or more in any 1 year). 
This rule does not reach the economic threshold and is not considered a 
major rule, thus we are not required to prepare an RIA. We provided a 
detailed history of the events leading to this final rule in the 
December 2018 proposed rule (83 FR 65120). We discuss our approach to 
Executive Order 12866 and demonstrate that this rule would not have 
economically significant effects because it not only removes 
requirements perceived by industry as burdensome, but it rescinds a 
regulation that, as a practical matter, was never operationalized or 
implemented by industry and thus had no demonstrable costs or savings. 
This final rule has been determined to be a qualitatively deregulatory 
action.
    The RFA requires agencies to analyze options for regulatory relief 
of small entities. For purposes of the RFA, small entities include 
small businesses, nonprofit organizations, and small governmental 
jurisdictions. Most hospitals and most other providers and suppliers 
are small entities, either by nonprofit status or by having revenues of 
less than $7.5 million to $38.5 million in any 1 year. Individuals and 
states are not included in the definition of a small entity. We are not 
preparing an analysis for the RFA because we have determined, and the 
Secretary certifies, that this final rule would not have a significant 
economic impact on a substantial number of small entities.
    In addition, section 1102(b) of the Act requires us to prepare an 
RIA if a rule may have a significant impact on the operations of a 
substantial number of small rural hospitals. This analysis must conform 
to the provisions of section 604 of the RFA. For purposes of section 
1102(b) of the Act, we define a small rural hospital as a hospital that 
is located outside of a Metropolitan Statistical Area for Medicare 
payment regulations and has fewer than 100 beds. We are not preparing 
an analysis for section 1102(b) of the Act because we have determined, 
and the Secretary certifies, that this final rule would not have a 
significant impact on the operations of a substantial number of small 
rural hospitals.
    Section 202 of the Unfunded Mandates Reform Act of 1995 also 
requires that agencies assess anticipated costs and benefits before 
issuing any rule whose mandates require spending in any 1 year of $100 
million in 1995 dollars, updated annually for inflation. In 2019, that 
threshold is approximately $154 million. This final rule will have no 
consequential effect on state, local, or tribal governments or on the 
private sector.
    Executive Order 13132 establishes certain requirements that an 
agency must meet when it promulgates a final rule that imposes 
substantial direct requirement costs on state and local governments, 
preempts state law, or otherwise has Federalism implications. Since 
this regulation does not impose any costs on state or local 
governments, the requirements of Executive Order 13132 are not 
applicable.
    Executive Order 13771, titled Reducing Regulation and Controlling 
Regulatory Costs was issued on January 30, 2017, and requires that the 
costs associated with significant new

[[Page 57626]]

regulations ``shall, to the extent permitted by law, be offset by the 
elimination of existing costs associated with at least two prior 
regulations.'' This final rule is an E.O. 13771 deregulatory action. 
Details on the estimated cost savings of this final rule are stated in 
the rule's economic analysis.

A. Cost and Savings

    As stated previously, and shown in this section, we estimate that 
this final rule will not have economically significant effects on 
industry. We again point readers to the September 2012 final rule where 
we referred to the large measure of uncertainty in the assumptions of 
our original impact analysis. In some cases, we indicated that the HPID 
would be ``foundational'' to subsequent activities such as the 
automation of the Coordination of Benefits (COB) process (77 FR 54705). 
In other cases, we stated that the costs and benefits associated with 
the HPID were applicable only to entities that are directly involved in 
sending or receiving HIPAA transactions and that the cost estimates 
were based on the number of health plans that would use the HPID in the 
transactions. However, we did not have data on how health plans were 
being identified in HIPAA transactions (77 FR 54703). Therefore, we 
stated that we had no assurance of how many health plans would use the 
HPID in standard transactions, and took a conservative approach to the 
costs to health plans. We were aware that covered entities were using 
Payer IDs to identify the health plan or the responsible entity in 
transactions. Although a few commenters did not agree with the 
methodology we chose for our cost analysis in the April 2012 proposed 
rule, we did not alter it in the September 2012 final rule.
    With respect to the estimated cost and benefits of implementation 
and use of the HPID, the December 2018 proposed rule reiterated the 
narrative from the April 2012 proposed rule, where we explained that 
the HPID would be foundational to other administrative simplification 
initiatives, both those initiated by industry, and those regulated by 
State or Federal governments. In the 2012 rulemaking, we suggested that 
if other initiatives did not follow, then the HPID would likely have 
little substantive impact (77 FR 22977). We explained that the HPID was 
intended to enable other initiatives, and would have been part of the 
larger picture of standardizing billing and insurance-related 
transactions and tasks (77 FR 54703). The HPID did not have the 
benefits or savings anticipated in the 2012 rulemaking, in part because 
of the longstanding enforcement discretion, and in part because 
industry identified other strategies to increase efficiency in how they 
conducted those transactions and other administrative functions.
    In the April 2012 proposed rule, we stated that the possible cost 
and benefit impacts were reflective of the uncertainty inherent in the 
health care industry. To illustrate the foundational aspects of the 
HPID, we estimated its implementation might contribute to a: (1) 1 to 2 
percent per year, for 10 years, increase in the use the eligibility for 
a health plan and health care claims status transactions; and (2) 1 to 
3 percent increase in the use of the electronic health care electronic 
funds transfers (EFT) and remittance advice transaction, as routing of 
those transactions is especially important for the payment process (77 
FR 22977). However, despite our exercise of enforcement discretion with 
respect to HPID compliance, the use of all three of these transactions 
has modestly increased, and we believe our assumptions that use of the 
HPID would contribute to an increase in the use of those transactions 
were incorrect. As we explained in the December 2018 proposed rule, 
some of the increases (and therefore savings) might have been due to 
the use of the adopted operating rules, while some might have been due 
to improved system capabilities.
    The Council for Affordable Quality Healthcare (CAQH) conducts a 
study each year (the CAQH Index) to assess the utilization of the 
administrative transactions and operating rules, and tries to identify 
savings opportunities from their use. The most recent report from 2018 
continues to show progressive adoption of the eligibility for a health 
plan, health care claim status, and health care electronic funds 
transfers (EFT) and remittance advice transactions. Entities conducting 
these transactions use Payer IDs for routing, other payer, and health 
plan identification purposes. While this study only includes those 
health plans and providers that participate by providing data, it 
remains indicative of a positive trend in the utilization rate for 
these transactions without the HPID. Table 1 shows the steady increase 
in industry's use of the three transactions over 6 years, which 
includes the 4 years when the HPID rule was in effect but, we believe, 
not in use due to the ongoing enforcement discretion. Recently, there 
has been a slight decline in use of the remittance advice transaction. 
CAQH is working with providers and health plans to understand reasons 
for that decrease in use.

                TABLE 1--CAQH Study Participant Adoption Rate of Certain Standard Transactions *
----------------------------------------------------------------------------------------------------------------
                                       Claim status (fully
                                         electronic) (%)           Eligibility (%)        Remittance advice (%)
----------------------------------------------------------------------------------------------------------------
2013..............................                       48                        65                        43
2014..............................                       50                        65                        46
2015..............................                       57                        71                        50
2016..............................                       63                        76                        55
2017..............................                       69                        79                        56
2018..............................                       71                        85                        48
----------------------------------------------------------------------------------------------------------------
* CAQH 2018 Efficiency Index, https://www.caqh.org/sites/default/files/explorations/index/report/2018-index-report.pdf.

    We cannot attribute other cost savings to this final rule because 
we do not anticipate any system transition costs, testing, or other 
conversion costs related to the deactivation of the identifiers. 
Consistent with our statements in the December 2018 proposed rule, 
covered entities did not make expenditures to prepare for use of the 
HPID during the enforcement discretion period. Organizations also did 
not execute new contracts for the services of software system vendors, 
billing companies, transaction vendors, and/or health care 
clearinghouses to facilitate the transition to the HPID. We invited 
industry comment on our assumptions regarding the cost estimates, and 
received support for the assumption that the costs would have 
outweighed the benefits of implementing the HPID.

[[Page 57627]]

    Comment: Several commenters supported our analysis in the December 
2018 proposed rule, suggesting that the cost of implementing the HPID 
would have outweighed any benefits. These commenters agreed that there 
was no return on investment for implementing the HPID because Payer IDs 
already serve the purpose of routing transactions. The commenters also 
noted that it would have been costly, complicated, and burdensome to 
implement the HPID because it would have required the mapping of 
existing Payer IDs to HPIDs. Specifically, a commenter stated it did 
not perform most health care transactions itself and, instead, engaged 
TPAs to perform these functions on its behalf. The commenter noted that 
complying with the HPID final rule would have required new and costly 
administrative procedures and extensive coordination with multiple TPAs 
that would have outweighed the utility of the HPID.
    Response: We thank commenters for validating our updated 
assumptions in the December 2018 proposed rule impact analysis 
regarding the lack of a return on investment from the September 2012 
final rule. The commentary from stakeholders regarding the cost of HIPD 
implementation and the inability to demonstrate an improvement in 
administrative efficiencies from such implementation has been 
consistent for several years, as demonstrated by review of the HPID 
testimony on the NCVHS website at https://ncvhs.hhs.gov/meetings/agenda-of-the-may-3-2017-ncvhs-subcommittee-on-standards-hearing-on-health-plan-identifier-hpid/ or the December 2018 proposed rule at 83 
FR 65118.
1. Costs
    The federal government has already expended certain operating 
funds, as have those organizations that applied for and obtained an 
HPID or OEID. For example, the federal government spent $1.5 million to 
build the components of the enumeration system and spent $45,000 
annually for operations and maintenance through 2018. As we stated in 
the December 2018 proposed rule, we cannot account for industry legal 
or administrative expenditures in the analysis of the number or type of 
HPIDs or OEIDs obtained following publication of the September 2012 
final rule.
    Costs associated with the deactivation--preparing communications, 
posting alerts on the HPOES web page, updating the DNS website, and 
programming to turn off system access to the HPOES module--are 
considered agency operating costs that HHS will absorb, without the 
need for additional funds.
2. Savings (Cost Avoidance)
    We believe that this final rule rescinding the HPID and OEID will 
yield modest savings (cost avoidance). First, as enforcement discretion 
remains in effect, we assume there are no new costs for health plan or 
other entity enumeration of new health plans or other entities. In the 
December 2018 proposed rule, we acknowledged that some of the 
assumptions in our 2012 rulemaking were outdated and requested industry 
feedback on our use of those assumptions for purposes of the analysis, 
but received no comments. Therefore, we are using the same data to 
confirm that this final rule provides a modest savings/cost avoidance.
    Based on the data in Chart 2 of the April 2012 proposed rule (77 FR 
22970), and reprinted here for reference, we estimated there would be 
up to 15,000 entities that would be required, or would elect, to obtain 
an HPID or OEID.

  TABLE 2--Number and Type of Entities That Were Expected To Obtain an
                              HPID or OEID
------------------------------------------------------------------------
                                                             Number of
                     Type of entity                          entities
------------------------------------------------------------------------
Self-insured group health plans, health insurance             \*\ 12,000
 issuers, individual and group health markets, HMOs
 including companies offering Medicaid managed care.....
Medicare, Veterans Health Administration, Indian Health       \**\ 1,827
 Service................................................
TriCare and State Medicaid programs.....................              60
Clearinghouses and Transaction vendors..................       \***\ 162
Third Party Administrators..............................      \****\ 750
                                                         ---------------
    Total...............................................          15,000
------------------------------------------------------------------------
* Report to Congress: Annual Report on Self-Insured Group Health Plans
  by Hilda L. Solis, Secretary of Labor, March 2011.
** Patient Protection and Affordable Care Act; Standards Related to
  Reinsurance, Risk Corridors, and Risk Adjustment, July 8, 2011 Federal
  Register (76 FR 40458) referencing data from www.healthcare.gov.
*** Health Insurance Reform; Modifications to the Health Insurance
  Portability and Accountability Act (HIPAA) Electronic Transaction
  Standards; Proposed Rule, https://edocket.access.gpo.gov/2008/pdf/E8-19296.pdf, based on a study by Gartner.
**** Summary of Benefits and Coverage and the Uniform Glossary; Notice
  of Proposed Rulemaking, https://www.gpo.gov/fdsys/pkg/FR-2011-08-22/pdf/2011-21193.pdf.

    As we stated in the December 2018 proposed rule, slightly fewer 
than 11,000 entities applied for and obtained an HPID immediately 
following publication of the September 2012 final rule. We explained 
the cost calculation for enumeration in the April 2012 proposed rule 
(77 FR 22970). Health plans and other entities were required to 
complete the application or update form online through the HPOES. We 
received most applications shortly after publication of the September 
2012 final rule, subsequent to which the application rate slowed 
considerably. Between May 2016 and May 2017 we received only 156 
applications for HPIDs, and, since the December 2018 proposed rule was 
published, we have received only 5 applications.
    The HPID and OEID application is a one-time burden, and for 
purposes of this impact analysis, we estimated the impact of 
eliminating that burden.
    The cost avoidance calculation associated with rescinding the HPID 
and OEID is premised upon the same method that we used to estimate the 
cost to apply for an HPID or OEID. We estimated that it took 30 minutes 
to complete the online application or make updates, and used an hourly 
labor rate of approximately $23/hour, the average wage reported for 
professional and business services sector, based on data from the 
Department of Labor, Bureau of Labor Statistics, June 2011, ``Average 
hourly and weekly earnings of production and nonsupervisory employees 
(1) on private nonfarm payrolls.'' (https://www.bls.gov/news.release/empsit.t24.htm). If we increase the rate to account for 2018 dollar 
values (March 2018 table), to $31/hour, this represents a unit cost of 
$15.00 per HPID or OEID application.

[[Page 57628]]

For the initial enumeration of 11,000 entities, this cost would have 
been $165,000. Thus, to deactivate an HPID or OEID, we can assume the 
cost avoidance would be the same.
    Additionally, we estimate the potential savings (cost avoidance) 
for those entities that might have already updated their HPID or OEID 
records before the HHS deactivation and base our assumption on the 
actual number of updates to the HPOES system since 2013. Each year, an 
average of 95 records, or 1 percent of active applications, are 
deactivated or updated. Using the same unit cost described earlier in 
this rule, if 1 percent of the current organizations (110 entities) 
updated their HPIDs/OEIDs, the cost would be $1,650 (110 x $15). To 
account for any increase in wages and benefits, we multiply this by 2, 
and arrive at a sum of $3,300. This final rule may result in savings of 
$3,300. We typically provide ranges in an impact analysis, and so 
provide a high range of 3 percent as well. Therefore, our calculation 
means 330 entities would have made updates, for a total high-end 
savings estimate of $9,900 (330 x $15) x 2. When this final rule 
becomes effective, these updates will not be necessary or possible. 
Organizations that have obtained HPIDs or OEIDs will not be able to 
make changes to their accounts after the effective date of the final 
rule. See Table 3 for a summary of the savings for updates that will 
not be made to HPIDs and OEIDs on or after the effective date of the 
final rule.
    We proposed a cost-effective method to implement the HPID and OEID 
rescission, and finalize that proposal in this final rule. As described 
earlier, HHS will deactivate the HPIDs and OEIDs on behalf of each 
entity and notify designated contacts in the HIOS system, while in a 
second wave of communication we will notify all active users in the 
HPOES module that the identifiers have been deactivated.
    We requested industry feedback on our assumptions and estimates 
regarding the deactivation of the HPIDs and OEIDs. We received support 
from commenters for our proposal that we would conduct the deactivation 
at HHS. Commenters suggested we notify several individuals on record at 
each company in case turnover had occurred. In Section II. E. of this 
final rule, we describe the deactivation process and communication 
strategy we will employ.
3. Summary of Costs and Savings for the Proposal To Rescind the HPID

                         Table 3--Savings (Cost Avoidance)--Updates That Would Not Have To Be Made to HPIDs and OEIDs After 2020
--------------------------------------------------------------------------------------------------------------------------------------------------------
                                                               2020
                       Savings                        ----------------------    2021       2022       2023       2024       2025       2026       2027
                                                           1%         3%
--------------------------------------------------------------------------------------------------------------------------------------------------------
Updates to enumeration...............................     $3,300     $9,900         $0         $0         $0         $0         $0         $0         $0
                                                      --------------------------------------------------------------------------------------------------
    Total............................................      3,300      9,900  .........  .........  .........  .........  .........  .........  .........
--------------------------------------------------------------------------------------------------------------------------------------------------------

D. Regulatory Review Costs

    Regulations impose administrative costs on private entities, such 
as the time needed to read and interpret a proposed rule, and we 
included estimates for the costs associated with the review of our 
documents. We assumed that commenters on the proposed rule would be 
representative of HIPAA covered entities and their business 
associates--primarily health plans, health care clearinghouses, health 
care providers, and vendors. However, it was not possible to quantify 
or estimate the number of entities, or number of individuals within 
each entity, who would participate in reviewing the proposed rule. Our 
best method of estimation was premised on the number of organizations 
that submitted comments on previous HIPAA standards and operating 
rules-related regulations as well as organizations that had 
participated in NCVHS hearings. HHS has received comments from 
approximately 100 to 150 commenters on past HIPAA regulations, while a 
similar number of organizations testify at or listen to NCVHS hearings. 
We acknowledged our assumptions may be imperfect and might result in an 
under- or -overstatement of the cost calculation for the review of the 
proposed rule, and we also recognized that the proposed rule might 
affect various types of covered entities in different ways, thus 
influencing the numbers of individuals or entities that may have read 
the proposed rule. For purposes of our estimate, we assumed that each 
reviewer would read approximately 50 percent of the proposed rule. We 
estimated that multiple individuals from 150 entities would read the 
proposed rule and that the key readers would likely be the information 
systems manager and legal staff. Using the wage information from the 
BLS for Computer and Information Systems managers for insurance 
carriers (Code 11-3021), we estimated that the cost of reviewing the 
proposed rule would be $70.07 per hour, including overhead and fringe 
benefits (https://www.bls.gov/oes/current/oes113021.htm). Assuming an 
average reading speed, we estimated that it would take approximately 
2.5 hours for a person to review half of the proposed rule. For each 
reviewer, the estimated cost was projected to be $175.17 (2.5 hours x 
$70.7), and we estimated the total industry cost of reviewing the 
proposed rule to be $175 x 150 reviewers = $26,250. We received no 
comments on this section of the proposed rule.

E. Alternatives Considered

    We were not required to provide alternatives for our proposal in 
the December 2018 proposed rule because we did not provide a full 
regulatory impact analysis. Furthermore, we fully discussed our reasons 
for proposing to rescind the HPID and OEID. However, we did consider 
several alternatives before making our proposal, including the effects 
of these alternatives. We provided our rationale for not selecting 
these options in accordance with OMB Circular A-4, which directs 
agencies to consider, among other things, a range of regulatory and 
non-regulatory alternatives, including different choices defined by 
statute, different compliance dates, market-oriented approaches, and 
different enforcement methods.
    We considered allowing covered entities to apply for and use the 
HPID or OEID voluntarily for their own purposes, or between willing 
trading partners, but rejected this option because there had been no 
demand for the use of these identifiers. Industry clearly stated that 
there was no business use case for the HPID and OEID and there was no 
anticipated benefit or savings from their use in HIPAA transactions or 
for other purposes. A voluntary model employing the HPID

[[Page 57629]]

and OEID likely would have resulted in confusion and disagreement 
between trading partners, thereby also likely engendering costs.
    At the May 3, 2017 NCVHS hearing, two commenters suggested that HHS 
consider alternative uses of the HPID, such as placing it on health 
insurance identification cards to assist with better understanding of 
patient coverage and benefits (including its use in patient medical 
records to help clarify a patient's healthcare benefit package). A 
commenter stated that the HPID could be used for enforcement or 
certification of compliance of health plans.
    As we have noted, the statute requires us to adopt a standard 
unique health plan identifier. HHS remains open to industry and NCVHS 
discussion and recommendations for appropriate business case(s) that 
meet the requirements of administrative simplification and we will 
explore options for a more effective standard unique health plan 
identifier.
    We did not receive any comments on these proposals, nor were any 
alternatives offered.
    In accordance with the provisions of Executive Order 12866, this 
final rule was reviewed by the Office of Management and Budget.

List of Subjects in 45 CFR Part 162

    Administrative practice and procedures, Electronic transactions, 
Health facilities, Health insurance, Hospitals, Medicaid, Medicare, 
Reporting, and recordkeeping requirements.

    For the reasons set forth in the preamble, the Department of Health 
and Human Services amends 45 CFR part 162 to read as follows:

PART 162--ADMINISTRATIVE REQUIREMENTS

0
1. The authority citation for part 162 is revised to read as follows:

    Authority: 42 U.S.C. 1320d--1320d-9 and secs. 1104 and 10109 of 
Pub. L. 111-148, 124 Stat. 146-154 and 915-917.


Sec.  162.103   [Amended]

0
2. Section 162.103 is amended by removing the definitions of 
``Controlling health plan (CHP)'' and ``Subhealth plan (SHP)''.

Subpart E--[Removed]

0
3. Subpart E, consisting of Sec. Sec.  162.502 through 162.514, is 
removed and reserved.

    Dated: October 15, 2019.
Alex M. Azar II,
Secretary, Department of Health and Human Services.
[FR Doc. 2019-23507 Filed 10-25-19; 8:45 am]
 BILLING CODE 4120-01-P