Select Page

data privacy unique identifierMany employers sponsoring self-funded plans have a negative recollection of a frustrating attempt to obtain a unique health plan identifier (HPID) until a last-minute reprieve was announced. At long last, the US Department of Health and Human Services (HHS) has proposed to eliminate the requirement that health plans obtain a HPID for purposes of transmitting HIPAA-governed electronic data.

As many recall, in 2014, self-funded health plans with more than $5 million in claims were required to obtain an HPID until HHS issued a last-minute indefinite delay. Self-funded plan service providers, such as third-party administrators (TPAs), were also subject to similar requirements. Now those requirements are almost certain to be eliminated for both health plans and related service providers.

So, what exactly is an HPID?

A HPID is a unique 10-digit number mandated under HIPAA electronic standard transaction rules. The HPID was intended to identify the health plan in electronic transactions referred to as electronic data interchange (commonly known as EDI). In tandem with the HPID, HHS created an “other entity identifier” (OEID) to be used by TPAs and others transmitting electronic health plan data.

Unless sponsoring a self-funded plan, health plan sponsors (employers) are not generally required to obtain an HPID because the plan’s electronic data are usually transmitted by TPAs, insurers and providers.

Many self-funded plan sponsors found the HPID registration process to be so taxing or difficult they chose not to complete the process, hoping for a delay. After that indefinite delay occurred, the HPID requirement is now more than likely to be officially eliminated.

A byzantine registration process

The employer registration process for obtaining a HPID turned out to be onerous, time-consuming and required multiple steps to complete. The process required an employer to do the following:

  • Identify all self-funded plans subject to the HPID requirement.
  • Determine how many HPIDs were required.
  • Determine the due date for filing (based on whether claims exceeded $5 million or not).
  • Gather the necessary data points for the registration.

The determination that the HPID is unnecessary

Based on overwhelming feedback, late in 2014, HHS delayed enforcement of the HPID requirement to consider recommendations of a public advisory body to HHS known as the National Committee on Vital and Health Statistics (NCVHS). In June 2017, NCVHS recommended that the HPID was unnecessary because of the lack of a business need for its use, confusion about the application of the rules and cost of the required modifications. Most health plans were already using the NAIC payer ID as its unique identifier and intended to continue using this identifier even if the HPID was required as well. NCVHS recommended that requiring use of the HPID would be both redundant and a significant disruption to administrative transactions.

What about other unique identifiers under HIPAA?

The impending formal revocation of the HPID is welcome relief for employers sponsoring self-funded health plans, especially those who struggled with the registration process in 2014. Although HIPAA contains a number of EDI requirements (including use of unique health identifiers), those requirements have been successfully implemented.

For example, rules for health providers (national provider identifier or NPI) are currently in effect and an employer is identified simply by the employer’s federal identification number (EIN) used for tax reporting purposes. The requirement that individuals be assigned a unique identifier has never pressed forward due to privacy concerns from the public. Self-funded plan sponsors can now breathe a sigh of relief that protections relating to EDI are all in place and the final EDI requirement to obtain an HPID will become a thing of the past.