PUBLIC COMMENTS CCHC Public Comment: National Standard Employer Identifier * This publication was produced by Citizens for Choice in Health Care and published here with their permission. August 14, 1998   Citizens for Choice in Health Care 1954 University Ave. W. Suite 8 St. Paul, MN 55104   Health Care Financing Administration Department of Health and Human Services Attention: HCFA-0047-P P.O. Box 26676 Baltimore, MD 21207-0519     To Whom It May Concern:   In response to HCFA's request for public comment, Citizens for Choice in Health Care is submitting the following comments on the proposed rule for the National Standard Employer Identifier.   Citizens for Choice in Health Care (CCHC) is a non-profit organization which was founded in 1995 to support individual choice and privacy in health care decisions for all citizens. Supported by members and contributors across the nation, CCHC seeks to protect patient and medical record confidentiality, to safeguard the critical patient-doctor relationship, and to support individual freedom and responsibility in all health care decisions.   PUBLIC COMMENTS BY CITIZENS FOR CHOICE IN HEALTH CARE   General Comments While the desire for efficiency is understandable, the implementation of the National Standard Employer Identifier will permit unwarranted federal monitoring of patient care, and linking of medical records through employers. This invasion of personal and medical privacy will diminish the excellence of the American health care system by creating barriers of distrust between doctors and patients and employers and employees. Such distrust may result in withheld information, increased health care costs, pain and suffering from delayed diagnoses, inaccurate diagnoses, and refusal to seek care for fear of disclosure or discrimination. Clearly, patients who are knowledgeable about the proposed identification and tracking system may opt to pay cash and demand paper transactions for record-keeping. This will increase costs to patients and decrease health plan expenses as patients, to protect their own privacy, leave the system for any conditions or care that they believe could be held against them in any discriminatory manner (ex. status, employment, insurability)     Provisions Applicability CCHC believes that no provider should be required to attach employment information, including the employer's Employer Identification Number (EIN) to a patient medical record or an individually-identifiable health care transaction without patient consent, unless the patient is enrolled in a self-funded plan which by necessity identifies the employer. For the self-employed or the employed who individually purchase their own coverage, there is no reason for health care transactions to identify employers. Employers are not part of the health care transaction. For employees who receive coverage through their employer using an independent insurer, the employer is using the employee's own wages to provide health insurance coverage for the employer. While this tax-free benefit is available only through the employer, there is no need to identify the employer in the health care transactions. This employer-sponsored benefit does not, and should not, statutorily preclude the patient's right to privacy from the employer&emdash;a potential problem in the event that all patients under one employer could, with the advent of computerized medical records, be pulled up on a computer for inspection by the employer.   Definitions: The addition of "private clearinghouses" under the category of Health Care Clearinghouses may place a larger financial burden on smaller entities which have a much smaller profit margin, but which may be able to keep confidential information more protected by virtue of their smaller size. The inclusion of "long term care" policies is unnecessary, as most people using long-term care policies are not employed. The cost to implement the HIPAA-EIN mandate will only add cost to the premiums paid by individuals and their families. Inclusion of "(k) Other transactions" will give the Secretary power carte blanche to increase the administrative and financial burden on individual practitioners by adding transactions to the list without a public comment period.   Overstepping the Statute: Unfortunately, federal agencies occasionally try to expand on statutory language. This is a case in point. Adding "Coordination of Benefits" to the list of transactions expands the statutory language in section 1173 beyond health plans to health data clearinghouses and providers. The statute does not include clearinghouses and providers in the Secretary's standards for coordination of benefits and sequential processing of claims.   DHHS tries to rationalize the inclusion of "Coordination of Benefits" as a transaction even after saying that, "This particular provision [Section 1173(a)(2) of the Act, section 1173(f)] does not state that these[coordination of benefits and sequential processing of claims] should be standards for electronic transfer of standard data elements among health plans." Their rational: "[W]e believe that the Congress, when writing this provision, intended for these standards to apply to the electronic form of transactions for coordination of benefits and sequential processing of claims."   If Congress meant to add Coordination of Benefits to the list of transactions pertaining to health care providers and health data clearinghouses, it would have been written as such or added in subsequent legislation. However, that is not the case. Perhaps Congress believed that health care providers should be allowed to work independently to coordinate benefits. Perhaps Congress feared that placing all coordination of care under one standard would actually bring the nation more quickly to the national health care system Congress rejected in 1994.   Standard CCHC does not support the use of the EIN as the Employer Identifier Standard. Rationalizing its use by stating that it was selected because of the "widespread use of the EIN to identify the employer in health transactions" is to ignore the fact that use of the EIN was statutorily limited, and current use may not actually be statutorily authorized. Although the IRS concurred on the legality of using the EIN, that legality has not been made clear in the proposed rules. Under "Approved Uses" the only approved uses mentioned are income tax purposes, implementing certain provisions of the Food Stamp Act of 1977 and the Federal Crop Insurance Act. DHHS writes that it may not be used in any activity otherwise prohibited by law. The fact that there appears to be no federal statute prohibiting its use cannot be interpreted to expressly permit mandatory use for a significant and broad intrusion on employer and employee privacy.   Proposing to expand the mandatory use and reporting of the EIN by federal statute should give employers and employer organizations cause for concern. Use of the EIN, a tax identification number, which has been limited by statute may become the government's broad business tracking number, much like the Social Security Number (SSN), a tax identification number, has become the tracking number on individuals for the government and private businesses. When the SSN was implemented, Congress promised that it would not become a personal identification number. However, over 20 new uses for the SSN have been added to federal statutes since the 1974 Federal Privacy Act was enacted to restrict its history of expanded use.   Requirements The proposed rules require individuals, individual providers, health plans and health care clearinghouses to obtain the EIN directly from the employer, and require employers to disclose their EIN. Although the EIN is indeed not confidential, employers may have a great deal of concern over protecting the privacy of themselves, their families and their employees.   Note that Federal and state agencies may "place additional requirements on their health plans." Does this mean on only the health plans involved in state and federal programs, or does this pertain to all the health plans in a state or under federal jurisdiction? What additional requirements? This undefined requirement gives federal and state agencies power to change the final employer identifier rule at any time they choose. Final rules should not allow this flexibility.   As stated earlier, no health care provider should be required to place the EIN on all health care transactions without the consent of the patient, parent of the patient, or employee. Patients will begin to feel as though every word, test, and diagnoses will be available to the employer and the government. Already state and federal occupational health care databases are being proposed or implemented. In addition, the "New Hires" database is fully functional in most states. Placement of the EIN on all health care transactions and the ability of government officials to readily access this information will harm patient-doctor relationships and inhibit the practice of good medicine.   CCHC believes that no employer must be required to disclose their EIN under threat of monetary penalties. (Note: It is improper to propose rules, promise future enforcement, and delay the proposal of enforcement procedures until the rules have been implemented since the proposed enforcement procedures may change one's view on the entire proposal)   Clearly Congress has forgotten that it has been elected to represent the people, not oppress them and intrude on their private information and confidential trusts. As stated in the proposed rules, DHHS believes the authority to require employer compliance with divulgence of EINs is "implicit" in the statute. DHHS does not know and has not asked for statutory authority. That they are unable to identify any reason for an employer to refuse, is evidence that they have not clearly defined the privacy, liberty, and confidentiality repercussions in the disclosure.   Implementation CCHC is opposed to implementation of the standard for all the reasons defined above. The fact that employers will find themselves besieged by requests for the EIN will eventually force employers to attach their EIN to every health care transaction, including enrollment and disenrollment, in an attempt to limit staff time required for answering requests for the EIN. This may even initiate broad application of the EIN to every employer data system in an effort to streamline operations. This will cause full implementation of another numbering system on citizens; a numbering system that will ease the ability of others to track citizens as they move from job to job.   Revisions No individual revisions or waivers should be allowed without nationwide public comment. Such waivers could permit expansion of statutory language by entities involved or increased access to EINs or employee health data without the public oversight allowed through a public comment period.   Impact Analysis DHHS accurately stated that the "the overall impact analysis makes clear that, collectively, all the standards will have a significant impact of over $100 million on the economy." They were also accurate to note the more substantial impact that will be experienced by small entities. Under the requirements of the Unfunded Mandates Reform Act of 1995, DHHS has made it clear that they "do not have sufficient information to provide estimates" of the impact of the standards on State and local governments, but said that several Medicaid agencies have estimated the cost to be $1 million per State to implement all the standards. CCHC would submit that the estimate is low given the history of State agencies to return year after year to state legislative budget committees with requests for additional assistance to complete projects under revised and higher cost estimates.   Executive Order 12866 DHHS missed the most significant impact in their response to the provisions of Executive Order 12866. Although the economic impact of the Employer Identifier is noted for health care providers, health care plans, health care clearinghouses, and employers, at no time is the economic impact on patients, enrollees and citizens addressed. Whatever economic impact is sustained by the four entities listed in this section of the proposed rules, the impact will be passed onto patients and enrollees in higher health care costs, and onto citizens in higher taxes to regulate, monitor, and enforce the system. Such increases in personal, insurance, and taxpayer costs will decrease the ability of citizens to access health care. In addition, the costs of compliance may also translate into decreased quality of care for patients as providers and health plans are forced to expend more funds to comply with the standard and avoid monetary penalties. Any additional economic squeezes may cause health plans to shrink their networks, smaller practices to close, doctors to limit time with each patients in order to see more patients per day, and hospitals to encourage more rapid discharge than currently is the practice. This will only worsen the access and quality problems experienced by patients in a system of capitation, DRGs, uncompensated care, and decisions by insurers to deny coverage for medical care already provided.   Additional Privacy Concerns   It forces employees to disclose their place of employment before provision of health care services and calls into question who will be penalized for employee/patient refusal to comply, or for inaccurate employer information by those employees who prefer to remain anonymous or unlinked to their employers. In addition, will health care services be denied for patients who refuse to give out the name of their employer? Under "Health claim status" this would imply that employees must know their employer's EIN in order to request the status of their health care claim. Many employees would therefore need to know another number, besides their health plan number, and in some cases their SSN, before accessing important individual information. It may be possible that by knowing the EIN of a employer, inquisite, intrusive, or malevolent persons may achieve access to confidential information on employees. Clearly, "First Report of Injury" (under Provisions/Definitions) is an invasion of confidentiality. This appears to be a wide-open category of access which will allow those to whom reports are made to link patients with employers even if employment is not related to the injury sustained.   Conclusion CCHC cannot support mandatory submission, use, and reporting of the EIN which can be linked with other individually-identifiable information to build citizen profiles which will include confidential and sensitive medical record information. The implementation of yet another number for tracking citizens through their use of health care services&emdash;a time of great personal vulnerability&emdash;is not acceptable in a free society regardless of the apparent convenience and efficiency that would result. Citizens in a free society must be free to protect their privacy and their persons from unwarranted government oversight and monitoring.   In addition, DHHS has underestimated total costs, ignored privacy concerns, suggested that organizations make their own rules through application for a waiver, and overstepped the HIPAA statute in the mandate for use of the EIN and inclusion of Coordination of Benefits.   Thank you for this opportunity to make public comments on the proposed rule for a National Standard Employer Identifier. Please call #651-646-8935 with questions.   Sincerely,     Twila Brase, R.N. Public Health Nurse President    Citizens' Council on Health Care 1954 University Avenue West, Suite 8, St. Paul, MN 55104 Phone: 651.646.8935 / Fax: 651.646.0100, e-mail