Compliance NewsSpring 2012

Issued by Lockton Benefit Group

INSIDE THIS ISSUE

The Perils of Generosity: Honor the Terms of the Plan to Ensure Stop-Loss Coverage

Page 3-4

Medicare Facts and Fiction (and Why It’s Important to Know the Difference)

Pages 7-9

HHS Begins HIPAA Privacy and Security Audits of Employer Health Plans

Pages 1-2

State RoundupPages 10-13

RemindersPage 14

L O C K T O N C O M P A N I E S

DOL Proposes New Enforcement and Reporting Rules for Multiple-Employer

Health PlansPages 5-6

HHS Begins HIPAA Privacy and Security Audits of Employer Health Plans

The gloves are coming off. For several years, federal

authorities have focused HIPAA audit efforts on healthcare

providers. But now the Office of Civil Rights (OCR), an arm of

the U.S. Department of Health and Human Services (HHS),

has commenced random audits of employer health plans

to assess compliance with the HIPAA privacy and security

rules. Changes to the HIPAA law in 2009 increased the

penalties that can apply for noncompliance and imposed new

notification requirements if there is a breach of unsecured

protected health information (PHI). (See Compliance News,

Summer 2009.)

Through December 2012, KPMG auditors acting on behalf of OCR will perform up to 150 health plan audits to assess privacy and security compliance. Although the stated goal is for “compliance improvement,” if an auditor finds a serious compliance issue OCR may initiate a further investigation to address the problem. Health plans’ business

2

associates are spared from the audits, at least for now, but likely will be subject to audits in the future.

How the Audits Work

Employers selected for an audit will receive a letter asking for documentation of their health plan’s privacy and security compliance efforts. Every audit will include a site visit during which auditors will interview key plan personnel and observe processes and operations. HHS expects to give the employer between 30 and 90 days advance notice of the on-site visit. Following the visit, the auditor will issue a draft report to the employer/plan sponsor. Prior to issuing the final report, the plan sponsor will have the opportunity to address the auditor’s concerns and describe any future corrective actions.

HHS Information Request

HHS will request the plan sponsor provide the following documents to KPMG within 10 business days:

� Administrative, physical and technical safeguards for electronic PHI, evidence that the plan has an information security policy including a disaster recovery plan and security management practices (workstation security, encryption policies, etc.);

� HIPAA privacy compliance: policies and procedures for safeguarding and using PHI, distributing a privacy notice, and training documentation for employees who handle PHI; and

� Breach notification processes in the event there is a breach of unsecured PHI.

Action Plans

Although HHS is conducting only 150 audits under the pilot program, plan sponsors who have access to PHI under their health plans should consider whether they have the requisite information to supply HHS if audited. More comprehensive audits, including audits of business associates, are likely on the horizon.

HHS Begins HIPAA Privacy and Security Audits (continued)

MARK HOLLOWAYSenior Vice PresidentDirector, Compliance ServicesLockton Benefit Group816.960.9567mholloway@lockton.com

Spring 2012 • Compliance News

3

The Perils of Generosity: Honor the Terms of the Plan to Ensure Stop-Loss Coverage

A pair of recent court cases illustrate the perils a

self-insured plan sponsor faces when it attempts

to do something nice for an employee or former

employee in terms of offering extended or

gratuitous health coverage, but fails to clear its

magnanimous act with the stop-loss insurer.

Stop-loss insurance, of course, reimburses the self-insured plan sponsor when the plan pays high-dollar claims that exceed certain thresholds known as “attachment points.” For example, a self-insured plan might have a stop-loss contract that requires the stop-loss carrier to reimburse the plan sponsor for claims paid by the plan in excess of $150,000 per year on behalf of any particular individual.

The stop-loss insurer’s responsibility, however, is limited to claims properly paid under the terms of the plan. When a plan sponsor goes “off plan,” and provides coverage or pays claims not provided for under the plan’s written terms, the stop-loss carrier generally has no obligation to provide the reimbursement expected by the plan sponsor . . . to the sponsor’s chagrin.

No Good Deed Goes Unpunished

In one recent case, an employer entered into a separation agreement with a retiring employee, under which the employer promised to provide additional (i.e., extended) COBRA coverage for the retiree. This created two potential problems for the plan sponsor. First, the plan document did not speak to extended COBRA coverage. Second, the stop-loss contract, which promised reimbursement of covered claims exceeding $200,000, excluded claims related to COBRA coverage not offered according to COBRA regulations.

As it happened, the covered retiree incurred almost $475,000 in claims during a year. The plan sponsor paid the claims and then sought reimbursement of a substantial portion of that amount, pursuant to the stop-loss contract. The stop-

4

loss insurer denied payment, noting that its contract was based on the terms of the plan—which did not contemplate extended COBRA coverage—and contained an express exclusion for claims incurred by an individual enrolled under COBRA coverage that the plan provided outside of the COBRA regulations.

The court, to the chagrin of the plan sponsor, sided with the stop-loss carrier, leaving the sponsor holding the bill for the entire amount of the claims.

In another case, an employer’s health plan document provided that employees on FMLA leave lost eligibility upon failing to return from the leave. As a result, under the terms of the plan (and under COBRA regulations) the employee’s COBRA qualifying event occurred then, upon the employee’s failure to return from leave.

Nevertheless, when one employee failed to return from leave the employer placed her on short-term disability and continued her coverage for six months, after which the employer terminated her employment and offered her COBRA. The former employee incurred substantial claims while on COBRA coverage, for which the plan sponsor sought reimbursement from the stop-loss insurer.

The reinsurer balked, noting that the former employee’s election of COBRA coverage was untimely because, under the terms of the health plan, COBRA should have been offered (and elected) shortly after the employee failed to return from FMLA leave. There was no authority under the terms of the plan, argued the stop-loss insurer, for continuing the employee’s eligibility for six additional months after the expiration of short-term disability.

The court agreed, taking the stop-loss insurer off the hook and leaving the plan sponsor responsible for the entire amount of the employee’s covered claims.

The Moral of the Story

ERISA requires plan administrators (typically, the plan sponsors) to administer their plans in accordance with the terms of those plans. Stop-loss contracts are underwritten and priced based on the benefits and coverages described in the plans. When a self-insured plan sponsor goes “off-plan,” even for the best or most generous of reasons, it does so at its peril. The result is not only an ERISA violation (plan fiduciaries who approve the extra contractual benefits are potentially personally liable to repay the plan); it also leaves the employer exposed to large claims without the protection of its stop-loss contract.

This is not to say that sponsors should never consider expanding coverage. The moral here is that in a case where an employer wishes to do so, it should formally amend the plan to reflect the extension, and obtain the stop-loss carrier’s buy-in.

ED FENSHOLTSenior Vice PresidentDirector, Compliance ServicesLockton Benefit Group816.960.9775efensholt@lockton.com

The Perils of Generosity (continued)

When a self-insured

plan sponsor goes

“off-plan,” it does so

at its peril.

Spring 2012 • Compliance News

5

DOL Proposes New Enforcement and Reporting Rules for Multiple-Employer Health Plans

The U.S. Department of Labor (DOL) has issued proposed regulations

that give the agency new tools to combat fraudulent multiple-

employer health plans (multiple-employer welfare arrangements, or

MEWAs). The new rules are a byproduct of a provision in the health

reform law that gives the DOL new powers to regulate MEWAs.

Background

MEWAs provide health and welfare benefits to employees of two or more unrelated employers who are not parties to bona fide collective bargaining agreements. MEWAs are sometimes marketed using attractive but actuarially unsound premium structures that generate large administrative fees for the promoters, but often leave insufficient funds to pay benefits.

States and the federal government coordinate the regulation of MEWAs. The DOL enforces the fiduciary provisions of ERISA against MEWA operators, and has been actively investigating and litigating issues connected with MEWAs. Through September 2011, the DOL initiated 821 civil and 314 criminal investigations.

State insurance departments typically view self-insured MEWAs as akin to unlicensed insurance companies, and either prohibit them outright or require them to meet licensing and reserve requirements similar to those that apply to insurance companies.

The Form M-1 Reporting Requirement

The 1996 HIPAA law added a new reporting requirement for MEWAs (Form M-1) to help the DOL assess a MEWA’s compliance with HIPAA’s portability rules. Importantly, the M-1 reporting requirement contains a number of exemptions for what are sometimes referred to as “inadvertent MEWAs,”

6

such as:

� Plans that cover a small number of independent contractors; no filing is required if the number of people who are covered but not employees or former employees of the plan sponsor does not exceed 1 percent of the total number of employees or former employees covered by the plan, determined as of the last day of the reporting year;

� Plans that cover employees of a former subsidiary; if coverage is extended to a former subsidiary company’s employees due to a change in control of businesses (such as a merger or acquisition) and the coverage is temporary in nature (that is, does not extend beyond the end of the plan year following the plan year in which the change in control occurs); and

� Plans that cover employees of a sponsor’s subsidiary with respect to which the sponsor owns at least 25 percent at any time during the plan year.

It’s important to note that while some MEWAs are excused from the M-1 filing requirement, they are still MEWAs and may be regulated by both federal and state authorities.

New Proposed Regulations

The new rules are intended to allow the DOL to better track a MEWA’s location and financial condition. Specifically the new rules would:

� Require MEWAs to register with the DOL by filing a Form M-1 prior to operating in a state or be subject to substantial penalties (under current rules, the MEWA’s first M-1 is due after the MEWA begins operating);

� Allow the DOL to issue a cease and desist order when it appears that fraud or other forms of abuse are taking place within a MEWA;

� Allow the DOL to seize assets from a MEWA when there is probable cause that the plan is in a financially hazardous condition; and

� Apply criminal penalties to false statements or representations made on the Form M-1.

The proposed regulations would retain the existing exemptions for “inadvertent MEWAs” noted above. For now, the new rules are only proposed but should be finalized sometime later this year.

DOL Proposes New Enforcement (continued)

MARK HOLLOWAYSenior Vice PresidentDirector, Compliance ServicesLockton Benefit Group816.960.9567mholloway@lockton.com

Spring 2012 • Compliance News

7

Medicare Facts and Fiction (and Why It’s Important to Know

the Difference)

Medicare bears an important relationship to

employer-sponsored benefit programs. In some

cases an employer’s health plan pays primary

to Medicare, in some cases secondary. Medicare

coverage may affect an individual’s COBRA

rights, his or her right to make health savings account contributions, and the applicability of penalty

taxes for certain health savings account withdrawals. Here are some statements about Medicare and

its relationship to employer-based benefits. See if you can determine which statements are true, and

which are false.

Here’s an important assist: The distinction between Medicare eligibility on the one hand, and

Medicare entitlement (e.g., Medicare coverage) on the other, is often critical.

An employer-based health plan pays secondary to Medicare on behalf of active employees (or their dependents) who are covered by Medicare due to age or disability.

Mostly false. When employer-provided coverage to an employee or dependent is due to the employee’s current employment status, Medicare coverage is almost always secondary.

There is an exception—that is, Medicare pays primary—if the Medicare coverage is due to age and the employer’s controlled group has (or had, as the case may be) fewer than 20 employees for much of the current or previous calendar year. There is a second exception where the Medicare coverage is due to disability and the employer’s controlled group had fewer than 100 employees for at least half of the previous calendar year.

There is a sort of reverse exception—under which the employer plan pays primary even where it would normally pay secondary—where the Medicare-enrolled individual is covered by Medicare due to end-stage renal disease. Medicare is typically secondary for the first 30 months even where it would otherwise have paid primary (for example, where the individual’s coverage is retiree coverage and thus not provided due to current employment status).

8

A plan is not required to offer COBRA coverage to an individual who is covered by Medicare on the date of the COBRA qualifying event.

Used to be true, but now is false. Under current law, if an individual is entitled to (i.e., covered by) Medicare on the date of the qualifying event or at any time before he or she actually makes an election for COBRA coverage, the plan must still offer the COBRA coverage.

On the other hand, if the individual becomes entitled to (i.e., covered by) Medicare after the date he or she elects COBRA coverage, the plan may terminate COBRA coverage once the Medicare coverage begins.

� Example: John loses health coverage due to termination of employment on July 1. On that date, John is entitled to (covered by) Medicare. The plan must offer COBRA coverage to John.

� Example: Same facts, except John becomes entitled to (covered by) Medicare on September 1, several days before electing COBRA coverage. The plan must nevertheless offer COBRA to John.

� Example: Same facts, except John becomes entitled to (covered by) Medicare on December 1, several weeks after electing COBRA coverage. The plan may terminate COBRA coverage.

Medicare Part A coverage automatically begins the moment an individual turns age 65.

Mostly false. Turning age 65 does not automatically trigger Medicare entitlement (i.e., Medicare coverage). Medicare coverage is automatic at age 65 only where on that date the individual is receiving Social Security benefits, such as Social Security disability benefits.

So if the individual does not apply for Social Security benefits at age 65, and also does not affirmatively apply for Medicare coverage then, Medicare coverage simply does not commence. It commences later, when the individual either commences Social Security benefits, or affirmatively (and successfully) applies for Medicare coverage while deferring Social Security benefits.

Medicare eligibility precludes an individual from making health savings account (HSA) contributions.

False. Medicare entitlement (i.e., coverage) precludes an individual from making HSA contributions. Mere Medicare eligibility is inconsequential.

Medicare Facts and Fiction (continued)

Turning 65 does not automatically

trigger Medicare coverage.

Spring 2012 • Compliance News

9

ED FENSHOLTSenior Vice PresidentDirector, Compliance ServicesLockton Benefit Group816.960.9775efensholt@lockton.com

Medicare eligibility due to age extinguishes the potential excise tax on HSA withdrawals that are for non-qualifying expenses.

True. Here Medicare eligibility is the key. Once an individual becomes eligible for Medicare on account of age, withdrawals from his or her HSA are not subject to the 20 percent penalty tax that otherwise applies to withdrawals not used to reimburse qualifying medical expenses. The withdrawals are subject to ordinary income tax however.

An aged employee who is receiving Social Security benefits and who wishes to make HSA contributions may disclaim (i.e., reject) Medicare coverage to make himself or herself eligible to make those contributions.

False, according to a recent federal court decision. According to the court, once an individual attains age 65 and is receiving Social Security benefits, Medicare Part A coverage is automatic. There is no provision under the law to disclaim these benefits. The employee might decide not to take advantage of Medicare, but no matter. He or she is nevertheless entitled to (covered by) Medicare, and therefore may not make HSA contributions.

10

Court: Massachusetts Cannot Deny Subsidized Health Insurance to Legal Immigrants

As the price tag for Massachusetts’s health reform law began to substantially exceed expectations, the Commonwealth sought to save about $130 million by moving approximately 29,000 legal immigrants off the rolls of Commonwealth Care, Massachusetts’s subsidized health insurance program. But several weeks ago, the Massachusetts Supreme Court ruled that banning the legal immigrants violated their rights to equal protection under the Commonwealth’s constitution.

The 2009 decision to drop the immigrants from the program was the result of the state’s budget crisis. Lawmakers said the move would save the state about $130 million.

The court emphasized that “fiscal considerations alone cannot justify” a state’s discrimination against legal immigrants.

Uninsured Massachusetts Residents Could Face Higher Penalty for Not Having Health Insurance

Residents of Massachusetts who do not have health insurance will face higher penalties for 2012, under the Commonwealth’s 2006 health reform law. The maximum penalty for those with incomes exceeding 300 percent of the federal poverty level will increase $4 per month in 2012, from $101 per month in 2011 to $105 per month this year.

However, penalties for those with incomes that are less than 300 percent of the federal poverty level are unchanged for 2012. Depending on income, those penalties range from $10 to $58 per month.

Penalties do not currently apply for individuals whose incomes are less than 150 percent of the federal poverty level, which is currently $16,344 for an individual and $33,528 for a family of four. The Commonwealth pays the premium for these individuals, who are eligible for free health insurance coverage.

State Roundup

Spring 2012 • Compliance News

11

Maine’s Universal Childhood Immunization Program Underway

In 2011, Maine enacted a childhood immunization program. The state created a board to implement the law, the Maine Vaccine Board (MVB). The MVB assesses a charge against all insurance companies, third-party administrators and other entities that pay for health benefits for Maine’s children.

Assessments are based upon the estimated vaccine costs, program expenses and the number of covered lives reported by the entity to the MVB. The Board set the assessment rate for the fiscal year commencing last July 1 at $6.98 per covered child per month. Children are covered until age 19.

The assessment is paid quarterly, within 45 days after each July 1, October 1, January 1 and April 1. Starting

October 1, 2011, payers were required to pay the assessment for the preceding quarter. Therefore, the first assessment was due no later than November 15, 2011.

The MVB assures that free vaccines are available to all of Maine’s children. Childhood vaccines are purchased under the federal contract rate, which is the lowest rate available.

Employers providing health coverage in Maine will see an indirect cost impact from the assessments. Those employers that buy group insurance will see the cost impact reflected in the price of their contracts. Those that self-insure will see the assessment passed through to them, from their third-party claim payers.

Washington Legalizes Same-Sex Marriage

On February 13, 2012, Governor Christine Gregoire signed into law a measure that makes Washington the seventh state to legalize same-sex marriage. The law takes effect on June 7, 2012.

A group called Preserve Marriage Washington is seeking a referendum to overturn the measure. If the group collects more than a specified number of valid voter signatures by June 6, the law will be put on hold pending the outcome of a November election.

If the law becomes effective, it will impact insured group health plans issued in Washington. Group health plans which are self-funded and subject to ERISA will not be affected by the law and may continue to define marriage as between one man and one woman, but we

12

State Roundup (continued) suspect most self-insured employers will conform to the state law.

The new law provides, as follows:

� Anyone with an existing domestic partner cannot marry, unless the partner is the other party to the marriage;

� Domestic partnerships that have not been dissolved or converted into marriages by June 30, 2014, will automatically be converted into marriages by that date;

� No regularly licensed or ordained minister or any priest, imam, rabbi or similar official of any religious organization is required to solemnize or recognize any marriage and will be immune to any lawsuit based on a refusal to solemnize or recognize any marriage; and

� Same-sex marriages entered into in other jurisdictions are valid in Washington.

New Jersey Governor Vetoes Same-Sex Marriage Legislation

On the opposite coast, Governor Chris Christie of New Jersey vetoed a bill allowing same-sex marriage in that state. Governor Christie renewed his call for a ballot

question to decide the issue. The veto came a day after the state Assembly passed the bill. The state Senate passed the bill on February 13, 2012.

Governor Christie reaffirmed his view that voters should decide whether to change the definition of marriage in New Jersey. “An issue of this magnitude and importance should be left to the people of New Jersey to decide,” Christie said in a statement.

Lawmakers in New Jersey have until the end of the legislative session in January 2014 to override Christie’s veto. They would need two-thirds of the lawmakers in the Assembly and Senate to agree. Both votes to pass the measure fell short of that mark.

New Jersey currently has a civil union law that was designed to provide the benefits of marriage to gay and lesbian couples without the title of “marriage.” Civil union legislation was adopted after the New Jersey Supreme Court instructed the legislature to provide marriage equality to same-sex couples.

Maryland Enacts Same-Sex Marriage Act

But just to the south of New Jersey, the Maryland Senate passed a same-sex marriage bill by a vote of 25 to 22 on February 23, 2012, following the bill’s passage by the Maryland House of Delegates on February 17, 2012. Governor Martin O’Malley vowed to sign the bill into law.

Washington state, New Jersey,

and Maryland consider same-

sex marriage legislation.

Spring 2012 • Compliance News

13

To win some of the final votes needed for passage, however, lawmakers agreed to conditions that could help opponents place the same-sex marriage law on the November ballot. If a petition is filed with the Secretary of State, and the number of signatures is sufficient and upheld as valid, the voters of Maryland will have the opportunity to weigh in on the bill. If a dispute arises as to the validity of the petition’s signatures, the Act will not take effect until the resolution of any litigation over the dispute.

If the opponents of the measure are unable to come up with the required signatures, the Act will take effect on January 1, 2013.

Federal Judge in California Rules Against DOMA

Back on the west coast, a federal judge in San Francisco ruled in late February that the U.S. government cannot deny health benefits to the wife of a lesbian federal employee by relying on the federal Defense of Marriage Act (DOMA). The judge declared DOMA unconstitutional and ordered the federal government to provide health benefits to the employee’s wife. The court found DOMA violated the employee’s right to “equal protection of the law . . . by, without substantial justification or rational basis, refusing to recognize her lawful marriage.”

The case was defended by the Bipartisan Legal Advisory Group, a panel of U.S. Representatives who intervened to defend DOMA after Attorney General Eric Holder said the administration would not do so. The lawyers

for the House panel argued that DOMA was enacted to protect traditional opposite-sex marriage. In his ruling, Judge Jeffrey White rejected their argument, noting that “tradition alone” doesn’t justify legislation that targets a vulnerable social group.

The ruling is the latest in a string of judicial setbacks for DOMA. A federal judge in Massachusetts ruled in July 2010 that the law is unconstitutional because it interferes with the right of a state to define the institution of marriage. In July 2011, 20 of the 24 bankruptcy judges based in Los Angeles ruled that the act violated the civil rights of married gay couples who were denied the right to file shared bankruptcy plans. Earlier in February 2012, the Obama administration said it would no longer defend the law in issues affecting actively serving military personnel and veterans in same-sex relationships.

JANAE SCHAEFFERERISA Compliance AttorneyLockton Benefit Group816.751.2240jschaeffer@lockton.com

14

Reminders

May 15, 2012 � Deadline to file Massachusetts “Fair Share

Contribution” Report.

July 30, 2012 � Deadline to make San Francisco Healthcare

Expenditure contributions for prior calendar quarter.

July 31, 2012 � Deadline for calendar-year plans to file Form

5500 for the prior plan year (unless extension is obtained).

SARA ROY, RP, CEBSAssistant Vice PresidentParalegalLockton Benefit Group816.960.9648sroy@lockton.com

Lockton Compliance ServicesAt Lockton, our mission is to be the worldwide value and service leader in employee benefits consulting and brokerage. Our goal is to provide uncommon results and service.

Our Compliance Services division helps enhance our service commitment to you. Our in-house attorneys and other professionals keep you up to date and in the know regarding important regulatory developments.

Circular 230 DisclosureAny advice in this document concerning a federal tax issue is not written or intended to be used, and cannot be used, for the purpose of avoiding federal tax penalties or

promoting, marketing or recommending any tax-related matters in this document.

www.lockton.com© 2012 Lockton, Inc. All rights reserved.

Images © 2012 Thinkstock. All rights reserved.