Compliance Checklist for 2024 Year-End

HIPAA Privacy Rule Changes

The newly published HIPAA Final Rule changes your health plans’ HIPAA privacy requirements (by enhancing protections for reproductive healthcare privacy). To prepare for the December 23, 2024, effective date, plan sponsors need to complete the following:

• Update the HIPAA Privacy Policies and Procedures Manual to include the new requirements (e.g., new category of prohibited disclosure, attestation requirement, etc.) and the plan’s procedures for addressing these protections.
• Ensure health plan staff who work with protected health information receive training on the new requirements.
• Review the plan’s Business Associate Agreements (BAA) and identify whether any revisions are needed to comply with the updated Final Rule.

Practical Tip: Download the model HIPAA attestation form and provide it if the requesting party is seeking protected health information (PHI) potentially related to reproductive health care for investigative purposes (e.g., to impose criminal or civil penalties). The attestation form is not required in all situations. If you need assistance with any of these steps, reach out to your Woodruff Sawyer service team for help.

Gag Clause Attestations

The Consolidated Appropriations Act, 2021 (CAA) prohibits group health plans and health insurance carriers from entering into certain agreements that contain “gag clauses” restricting the sharing of certain information (e.g., cost or quality of care information). Plans and carriers are required to attest that their agreements do not include such gag clauses each year.

• Complete the attestation by December 31, 2024.

The attestation form has been modified slightly this year to hopefully clarify some of the issues encountered during the first year’s attestations. Refer to our client alert for more detailed information about this requirement.

Practical Tip: Most carriers should have already adjusted their contracts to remove such clauses, but plan sponsors should still do a quick review of the contract/agreement to check for any provisions that limit the sharing of information with another party before making the gag clause attestation. The attestation itself should only take a few minutes and can be done any time before year-end.

HSA-Qualified HDHP Telehealth Relief

During the COVID-19 pandemic, various federal agencies released several temporary rule changes to provide employers and health plans relief during the challenging emergency period. One of these was the (very popular) telehealth safe harbor for Health Savings Account (HSA)-qualified High Deductible Health Plans (HDHPs), which enables these types of plans to provide first-dollar coverage for telehealth visits without losing their HSA-qualified status. However, this temporary telehealth relief will expire on December 31, 2024. Plan sponsors need to take inventory of the various benefits that may be impacted. We suggest you begin with these steps:

• Review your HSA-qualified HDHP plan’s coverage provisions for telehealth visits.
• Identify your group health plan’s carved-out or add-on telehealth benefits/services (including Employee Assistance Programs [EAPs] that provide significant medical care) that may be providing benefits to participants before the HDHP minimum deductible is met.

Practical Tip: At this point, it is unlikely that legislation could be introduced to further extend this relief prior to the end of 2024. There is some possibility that an extension may be granted after the 2025 plan year has already started (which may cause a different set of challenges in itself). Regardless, plan sponsors should prepare (or should have already prepared) their plan options with the expectation that this relief will expire in 2024. The first step is identifying the benefits that need to be addressed.

MHPAEA Final Rule

The Mental Health Parity and Addiction Equity Act (MHPAEA) requires plans that provide coverage for mental health and substance use disorder to take steps to ensure those benefits are offered in parity with those for medical or surgical conditions.

Since 2021, MHPAEA has required subject plans to have a written comparative analysis regarding the non-quantitative treatment limits (NQTLs, or non-numerical limits on the scope or duration of benefits for treatment such as preauthorization requirements) imposed by the plan. A new Final Rule released in September this year provided (among other things) additional guidance on the information required to be included in the comparative analysis.

In addition, the Final Rule heightened the diligence required of an ERISA plan’s fiduciary when it comes to the comparative analysis. Fiduciaries will be expected to provide a written certification that they have (1) engaged in a prudent process to select qualified service providers to perform and document a comparative analysis, and (2) monitored those service providers with respect to the performance and documentation of the comparative analysis. This is a new component of a plan’s comparative analysis and will be effective for plan years beginning on or after January 1, 2025.

To prepare to meet this requirement, plan sponsors are encouraged to:

• Reach out to the insurance carrier(s) and third-party administrator(s) to request information regarding their MHPAEA compliance preparedness, including a copy of any written comparative analysis they have or will prepare for the plan.
• Review the Department of Labor’s (DOL) MHPAEA Self-Compliance Tool, including its instructions for preparing the written comparative analysis themselves.
• Consider any further steps needed, such as hiring a vendor to perform a comparative analysis for the plan.

Practical Tip: Sponsors of fully insured plans may generally rely on the insurance carrier to perform the comparative analysis to ensure compliance with the parity rules. On the other hand, sponsors of self-funded plans will be expected to do more of the legwork. If a third-party administrator (TPA) does not provide the requested documentation, engaging a vendor to perform the comparative analysis is an option but one that comes with a relatively large price tag. Certain experienced plan sponsors might be able to use the DOL’s self-compliance tool, but this will take a commitment of time and effort.

It may be helpful to reach out to your legal counsel as well for authoritative advice on the benefits and risks presented by each option.

Final Non-Discrimination Testing and Corrections

If plan sponsors have not already done so, they should perform the nondiscrimination testing for the various benefit plans (e.g., Section 125 Cafeteria Plan, Health Flexible Spending Account (FSA), and Dependent Care Assistance Program [DCAP]) as soon as possible to ensure the plans comply with tax code rules.

Practical Tip: We recommend that plan sponsors perform the nondiscrimination tests in October or November to provide enough time to make any necessary adjustments/corrections to payroll within the same calendar year. Except for excess contributions to an HSA, benefits-related payroll adjustments should not cross over into the new year.

Congratulations, now that you’ve attended to and completed these final compliance housekeeping items for 2024, it’s time to enjoy the holiday season!

The Year Ahead

As with any change in administration, we expect new regulatory and legislative compliance obligations for health plans in 2025 and beyond. Many pundits are anticipating relief or reduced enforcement for some of the newly issued rules, but that remains to be seen, and it would take some time before the various agencies issue official guidance.

Woodruff Sawyer will monitor any developments and keep you informed about compliance obligations for your health plans. We will continue to release Compliance Alerts and will provide a discussion of these during our in-person seminars and at our Spring Compliance Hot Topics webinar, which we expect will take place in March. In the meantime, reach out to your service team with any questions or concerns.