Employee Benefits Briefing - April 2005

• Medicare Prescription Drug Act–What Do Employers Need To Do?

• HIPAA Security Rule Takes Effect

• District Court Blocks EEOC Rule Allowing Retiree Benefit Reductions At Medicare Facility

The Medicare Prescription Drug Improvement and Modernization Act (the "Act"), signed into law on December 8, 2003, is scheduled to go into effect on January 1, 2006. This new law, also known as "Medicare Part D," will offer prescription drug coverage for retirees and their beneficiaries who are enrolled in Medicare. Prescription drug coverage will be provided through either a Medicare Advantage Plan or a state licensed prescription drug plan. Standard coverage under Medicare Part D will pay for 75% of drug costs between $250 and $2,250 and all amounts over an out-of-pocket maximum of $3,600 (less the greater of a $2 (generic)/$5 (non-generic) co-pay or 5% of the drug’s cost). Enrollment in Medicare Part D runs between November 15 and May 15 (beginning November 15, 2005). Late enrollment requires the retiree to pay a higher rate.

Employers sponsoring group health plans covering Medicare-eligible participants must take action now in order to prepare for the impact this new benefit will have on their plans.

There are four (4) basic options for employers to consider:

• Option 1: Apply for a non-taxable federal subsidy equal to 28% of each eligible retiree’s annual prescription drug costs incurred between a $250 deductible and $5,000 (for 2006). To be eligible, the employer’s group health plan must provide prescription drug coverage that is at least actuarially equivalent to the standard prescription drug coverage available under Medicare Part D. The employer must also satisfy a twopronged test that needs to be attested to by an actuary on an annual basis. The first prong (referred to as the "gross value test") requires that the expected amount of paid claims for retiree drug coverage under the employer’s plan be at least equal to the expected amount of paid claims under standard Medicare Part D. The second prong (referred to as the "net value test") requires that the net value of the employer’s plan be at least equal to the net value under Medicare Part D (net value is determined by taking the gross value and reducing it by the amount of applicable premiums to be paid by the retiree under the employer’s plan and Medicare Part D, respectively).

• Option 2: Modify the group health plan to provide prescription drug coverage for retirees that supplements the coverage offered under Medicare Part D. For example, an employer plan could pay the deductible and co-pay amounts under Part D and for prescription drug costs between $2,250 and $3,600.

• Option 3: Qualify as a Medicare Advantage plan or contract directly with a Medicare Advantage or state prescription drug plan to cover the employer’s retirees. This option may be feasible only for large employers.

• Option 4: Terminate any existing employer-sponsored prescription drug coverage for retirees and consider reimbursing retirees for the cost of the Part D premium, $35 per month for 2006.

Other notes to keep in mind regarding the federal subsidy:

• Over-the-counter drugs or prescription drugs covered under Medicare Parts A (hospital charges) or B (physician services) are not taken into account.

• The subsidy covers only eligible retirees who are not enrolled in Medicare Part D and participate in the employer’s prescription drug plan. This prevents any "double dipping" under Medicare.

• Application forms for the subsidy are expected to be available to employers beginning August 3, 2005. The applications must be filed with the Department of Health and Human Services (HHS) by September 30, 2005. The application must include an actuarial certification that the employer’s plan meets the applicable conditions. HHS will approve or reject applications beginning October 21, 2005, and begin making subsidy payments to employers on February 28, 2006.

Employer-sponsored group health plans that cover Medicare-eligible participants must provide a Notice of Creditable Coverage to these participants. Medicare eligible participants include both retirees under the plan and active participants who continue to work past age 65, and their beneficiaries, who are Medicare eligible. Insured plans will likely have this notice provided by the insurer. The notice will inform participants whether their prescription coverage under the employer’s plan is actuarially equivalent to Medicare Part D and thus is "creditable coverage." If the coverage is not creditable, the notice must explain the time period during the year for enrolling in Medicare Part D and that a penalty may apply for late enrollment. This notice must be provided at the time of initial eligibility for Medicare Part D, before the effective date of enrollment in the employer’s plan or the date of any change in creditable coverage, and prior to each Medicare Part D enrollment period (November 15 to May 15). Currently there is no penalty imposed on plan sponsors for failing to provide this notice.

If you would like to discuss your options, please contact the Vedder Price attorney with whom you work directly.

The compliance date for the Security Rule, the next phase of HIPAA compliance, is upon us. Large plans must be compliant by April 20, 2005, and small plans (plans with under $5,000,000 in annual receipts) must be compliant by April 20, 2006. This bulletin provides a brief overview of the Security Rule and necessary compliance steps.

The goal of the Security Rule is to ensure that electronic protected health information (ePHI) that a health plan creates, receives or transmits is accessible but also kept confidential. This goal is achieved by requiring health plans to satisfy certain administrative, physical and technical standards. Examples of each standard are:

• Administrative standards: risk assessment and a sanction policy.

• Physical standards: procedures that permit the recovery of lost data and procedures that protect equipment from unauthorized access.

• Technical standards: automatic log-off and unique user identification.

To comply with the Security Rule, plan sponsors should take the following actions:

• Conduct a thorough review of how ePHI is received, transmitted and stored on the plan sponsor’s system. Determine, based on that analysis, potential risks to the security of such ePHI.

• Compare the plan sponsor’s computer/ information system’s security policies to the administrative, technical and physical standards laid out in the Security Rule. A complete list of the standards can be found in Appendix A to the Security Rule at: www.cms.hhs.gov/hipaa/hipaa2/regulations/ security.

• If necessary, adopt policies and procedures that comply with the Security Rule’s standards. If the standards were satisfied by current policies, document that conclusion.

• Amend existing business associate agreements to ensure that the business associate has implemented certain safeguards to protect ePHI. This will generally mean adding an additional paragraph to the standard business associate agreements.

• Appoint a Security Officer (one who is familiar with the plan sponsor’s systems), which may be the same person who was appointed under the earlier privacy rules.

• Review prior HIPAA amendments to make sure that they provide that: (i) administrative, technical and physical safeguards have been implemented to protect ePHI; (ii) the plan sponsor must report to the plan any unauthorized access or attempted access of ePHI; (iii) there is adequate separation between the plan and the plan sponsor; and (iv) any agent or subcontractor who receives ePHI agrees to implement security measures to protect such ePHI. In many cases, prior amendments already encompass these requirements.

The Center for Medicare and Medicaid Services (CMS) will be responsible for investigating violations of the Security Rule. CMS has stated that it will take a voluntary compliance approach to investigating and resolving Security Rule compliance. Civil monetary penalties will be imposed only if, after an investigation, the Covered Entity refuses to comply with the Security Rule or fails to take corrective action requested by CMS.

If you have any further questions on the Security Rule or would like assistance in complying with the Security Rule, do not hesitate to contact any member of our Benefits Group.

On March 30, 2005, a federal district court in Pennsylvania enjoined the Equal Employment Opportunity Commission (EEOC) from finalizing a rule allowing employers to reduce or eliminate health care benefits for retirees once they become eligible for Medicare without violating the Age Discrimination in Employment Act (ADEA). The district court in AARP v. EEOC concluded that the proposed exemption was inconsistent with the ADEA and Congress’ intent as interpreted in an earlier decision by the U.S. Court of Appeals for the Third Circuit, Erie County Retirees Association v. County of Erie (Erie County).

As we have previously reported in our Summer 2001 Bulletin, in Erie County, which was decided in 2000, the Third Circuit held that employers could not provide reduced health benefits for retirees once they became eligible to receive Medicare benefits. Any differences in benefits or premiums charged were permissible, the Third Circuit held, only if the plan’s design satisfied the ADEA’s equal cost/equal benefit rule. The employer’s plan in Erie County did not do so, the lower court later ruled, because the cost for coverage for Medicare-eligible retirees was less than the amount the employer was paying for pre-Medicare retiree coverage. The equal benefit standard was not satisfied because the Medicare eligible retirees were offered only an HMO option while the pre-Medicare retirees were offered a point-of service plan, and also because the total premiums paid by Medicare-eligible retirees, including premiums paid to the government for Medicare Part B coverage, were higher than those paid by pre-Medicare retirees.

The EEOC at first readily embraced the Erie County decision and incorporated the ruling into the compliance manual used by EEOC investigators. However, the following year, the EEOC rescinded its new policy pending further study after learning that its enforcement policy was prompting employers to discontinue providing any retiree medical benefits rather than risk ADEA liability for providing "equal benefits" to both pre-Medicare and Medicareeligible retirees. In 2003, the EEOC issued a proposed rule that would have exempted the coordination of retiree health benefit plans with Medicare eligibility from the prohibitions of the ADEA even if the equal cost/equal benefit rule was not satisfied. On April 22, 2004, the EEOC issued the rule in final form. The final rule was designed to permit employers to continue to maintain certain retiree health benefits programs, such as Medicare bridge programs, without being in violation of the ADEA.

The AARP challenged the final rule, filing suit in federal district court in Pennsylvania and arguing that it is contrary to the plain language of the ADEA and the Third Circuit’s decision in Erie County. The EEOC responded that, under Section 9 of the ADEA, the EEOC has the power to issue exemptions from provisions of the ADEA so long as the exemption is "reasonable" and "necessary and proper in the public interest." Although the district court was sympathetic to the EEOC’s arguments that employers would simply reduce benefits for pre-Medicare-eligible retirees (as happened to the Erie County plaintiffs) rather than increase benefits for Medicare-eligible retirees, it felt it was obligated to follow the Third Circuit’s earlier decision in Erie County and issued an injunction enjoining the EEOC from implementing the exemption.

At this point, the implications of the AARP decision are unclear. The AARP case does little more than confirm the prior decision in Erie County, and the EEOC has stated that it will not pursue cases involving the Medicare coordination of retiree health benefits coverage. Of course, retirees, especially those within the Third Circuit, which encompasses Pennsylvania, Delaware and New Jersey, may still pursue these cases on their own. The EEOC has already announced that it will appeal the AARP decision. However, that appeal must go to the Third Circuit Court of Appeals, which will be reluctant to reverse its prior decision. As a result, it may take a decision by the Supreme Court or action by Congress before the law is settled.

In the meantime, employers offering retiree health benefits will need to continue to engage in the type of risk analysis outlined in our Summer 2001 Bulletin, especially in connection with any potential program design changes.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.