Author(s): Jill A. Marsteller, Randall R. Bovbjerg

Other Availability: PDF | Printer-Friendly Page

Posted to Web: August 11, 1999

Permanent Link: http://www.urban.org/url.cfm?ID=309099

The nonpartisan Urban Institute publishes studies, reports, and books on timely topics worthy of public consideration. The views expressed are those of the authors and should not be attributed to the Urban Institute, its trustees, or its funders.

Note: For those wishing to print this report it is recommended that they use the PDF Version.

---

About the Series

Assessing the New Federalism is a multi-year Urban Institute project designed to analyze the devolution of responsibility from the federal government to the states for health care, income security, employment and training programs, and social services. Researchers monitor program changes and fiscal developments. In collaboration with Child Trends, Inc., the project studies changes in family well-being. The project aims to provide timely, nonpartisan information to inform public debate and to help state and local decisionmakers carry out their new responsibilities more effectively.

Key components of the project include a household survey, studies of policies in 13 states, and a database with information on all states and the District of Columbia, available at the Urban Institute's Web site. This paper is one in a series of occasional papers analyzing the information from these and other sources.

---

Contents

Introduction

Background: Managed Care Backlash, State Regulation, and ERISA Limits on States

Patient Protection Provisions

Federal Responses

Pending Federal Proposals

What Federal Legislation Means for States

Implementation and Enforcement

Conclusion

Notes

References

About the Authors

List of Tables

Table 1.	Managed Care Consumer Protection Bills in the 106th Congress
Table 2.	Application and Enforcement of Comprehensive Consumer Protection Bills under Consideration in the 106th Congress
Table 3.	Managed Care Patient Protection Provisions in Federal Bills, 106th Congress
Table 4.	Managed Care Penetration in 13 States
Table 5.	Managed Care Patient Protection Provisions in the 13 Focus States
Table 6.	Managed Care Regulation and HMO Penetration in the 13 Focus States
Table 7.	Consumers' ability to Sue for Injury Caused by Health Plan Coverage Decisions

---

Introduction

As indemnity health insurance has given way to managed care in the 1990s, state legislatures and Congress have considered an array of patient protection measures. Also called "consumer protection" acts or "Patients' Bills of Rights," such enactments respond to fears that some managed care practices too often mistreat enrollees (Blendon et al. 1998, Enthoven and Singer 1998). State legislators have imposed standards or processes on insurers and managed care organizations (MCOs), such as a minimum 48-hour hospital stay for childbirth, access to the emergency room or to specialists, and appeals processes for patients denied payment for care. Between 1996 and 1998, nearly 600 bills regulating MCOs were introduced in state houses across the country, and at least some provisions were enacted in every state (Stauffer 1998d).

Patient protection is a federal issue as well as a state one. At the federal level, many patient protections have already been imposed by legislation or Executive Order (White House 1998). The 105th Congress introduced some 50 bills focused on patient protection—many addressing only one issue, but others seeking comprehensive change. By mid-February 1999, the 106th Congress had introduced more than 10 comprehensive managed care reform bills.

How much practical difference additional federal legislation would make depends on both federal action and state conditions. Federal proposals vary in the portion of the population targeted for reform, the specific protections advanced, and the provisions for enforcement. State conditions vary in the amount and types of existing regulation and the types of coverage now in effect. For example, where there is little managed care penetration, managed care regulation will make little immediate difference. Where there is high self-insurance, new federal rules will matter greatly. Further, some enforcement responsibility might shift from states to federal agencies for insured managed care, and new federal enforcement would apply to self-insured managed care.

This paper begins by describing patient protection provisions already enacted by states and proposed in the three prominent federal approaches—Republican, Democratic, and bipartisan. It then assesses the impact federal legislation might have in 13 representative states, based on the relative importance of managed care in each state and existing state regulation. The paper also discusses enforcement and liability issues. The conclusion highlights important differences among the competing federal proposals and the most notable changes each would make for states.

Background: Managed Care Backlash, State Regulation, and ERISA Limits on States

The political push for patient protection legislation has followed a rapid shift from relatively unrestrained indemnity coverage to managed care, which now enrolls more than 75 percent of the privately insured (Ginsburg and Gabel 1998). A consumer backlash has arisen in response to the restrictions imposed by managed care, a relatively unfamiliar form of coverage. Often, enrollees did not choose these restraints, as many employers offer only one option for health coverage (Blendon et al. 1998, Gawande et al. 1998).

Many health care providers have also supported regulation of managed care because of its impact on clinical autonomy (and on provider fees). In fact, an early entry in the current round of legislation was the American Medical Association's (AMA's) model Patient Protection Act advanced in the early and mid-1990s. Originally, the AMA endorsed requirements that managed care networks be open to all physicians willing to participate, which would greatly inhibit plans' ability to contract selectively with providers, a key tool in cost and quality control (Marsteller et al. 1997).

There is a tension between the views that these laws "protect patients " versus"restrict managed care." Protecting patients seems like an unequivocally good notion (even though these laws apply only to insured patients). But regulating MCOs may also risk undermining their ability to control health spending or impede MCO growth. On the one hand, increased regulation has been supported by media attention to some bad outcomes (Brodie et al. 1998, HARP 1999b) and a widely expressed desire among patients for more power vis à vis their managed care plans. On the other hand, there is considerable market demand for managed care, which is often credited with having slowed health care inflation (Ginsberg and Gabel 1998), with little or no effect on quality (Miller and Luft 1994, 1997).

States are traditionally responsible for regulation of insurance and of medical quality, but state authority is limited by the Employee Retirement Income Security Act of 1974 (ERISA).¹ ERISA preempts all state laws (including legislative enactments, administrative rulings, and judicial proceedings) that "relate to" employee benefits plans—that is, almost all private coverage except government and church plans and individually purchased insurance. ERISA allows states to continue to regulate insurance products but not employee benefits plans. States have no regulatory levers over benefits design or administration of groups that self-insure. The existence of ERISA makes patient protection in private insurance a federal issue as well as a state one. Federal oversight is also implicated for federal programs—notably Medicaid and Medicare, the Federal Employee Health Benefits Program (FEHBP), and military-related programs.

Patient Protection Provisions

Some of managed care's differences from traditional insurance have become concerns for many consumers, health care providers, and policymakers. Patient protection measures seek to address four main sources of fear about managed care: (1) the use of provider networks, (2) restrictions on benefits, (3) utilization management techniques, and (4) financial incentives to providers and patients.

Limited Provider Networks

Networks are limited groups of providers, selected by an MCO, that enrollees must use to receive full payment for covered services. MCOs limit the number and types of participating providers for many reasons. Coordination of care is simpler among fewer physicians, and MCOs can select providers with compatible practice styles. In addition, a defined and limited membership allows MCOs to estimate a likely volume of patients for each provider and to negotiate service price discounts based on this expected volume. Furthermore, MCOs can impose treatment guidelines and administrative rules on network providers in a way that indemnity insurance cannot. Without the ability to contract selectively, necessarily excluding some providers, managed care would find it very difficult to effect the changes in medical spending and practice that large employers, governments, and other premium payers demand (GAO 1997a, Christianson 1998).

On the other hand, selective networks limit patient choice among providers at the time of service. An enrollee may not be able to visit a favored hospital or family doctor if the hospital or doctor is not included in the MCO network. Also, providers may leave or be "deselected" from networks, disrupting the provider-patient relationship. Further, if an enrollee develops a rare condition, there is a chance that preeminent specialists in that field will not be on the MCO's provider list. To visit these specialists, the enrollee would have to pay for the visit out-of-pocket, potentially a major barrier to access. Thus, providers and patients fear the limitation of choice inherent in the use of provider networks.

In response to these concerns, state and federal legislative proposals include such measures as:

• Network adequacy standards—These require MCOs to maintain an acceptable ratio of providers to enrollees. There may be set rules, such as having one primary care physician within 30 minutes or 30 miles of every enrollee, or looser requirements, such as showing or being able to show that networks are adequate to handle the needs of the enrollee population.

• Access to out-of-network care if network is inadequate—An extension of the previous requirement, this provision allows enrollees to visit out-of-network providers if no appropriate participating specialist is available in a timely fashion.

• Point of Service (POS) options or Freedom of Choice (FOC) requirements—These require MCOs to permit enrollees to access out-of-network health care providers by requiring some level of coverage for out-of-network use.

• Continuity of care requirements—These permit enrollees to continue their care with a health care provider for some transitional period if the provider leaves the network. Patients typically must have special conditions, such as pregnancy or chronic illness, to exercise this privilege.

• Rules for provider selection or termination—These include a range of measures that govern the formation of networks, such as requiring public disclosure of selection criteria, written explanations to providers of reasons for nonselection or termination, and restrictions on the factors MCOs may consider in selecting network providers. An extreme version is an any willing provider (AWP) law, which requires MCOs to allow any provider who is willing to accept an MCO's terms and conditions to be included in a network.

Other measures aimed at controlling the use of networks are less often seen or have less practical impact. These include requirements for access to alternative providers, such as naturopaths or acupuncturists, and clauses that prohibit discrimination among providers on the basis of various characteristics. The latter do not typically prohibit selective contracting.

Benefits

Managed care organizations may also restrict the scope of benefits covered or limit access to covered benefits in the search for greater efficiency. Among these practices are limits on lengths of hospital stay, restricted coverage of emergency services, exclusion of experimental treatments, and the use of drug formularies. Out of concern that MCOs' incentives to reduce costs will lead them to deny access to important services, legislation may require that specific benefits be provided. Among the typical provisions are:

• Emergency room (ER) coverage provisions—These require coverage of stabilization (and sometimes further service) for reasonable visits to the emergency room—for example, when a "prudent layperson" would think she required emergency treatment. The measures ban prior authorization for emergency services, and some require payment to emergency facilities outside the MCO's network.

• Access to clinical trials or experimental treatments—These rules require MCOs to cover routine costs of an enrollee's participation in clinical trials or coverage for experimental treatments.

• Breast cancer hospital stays—Similar to recent laws requiring MCOs to cover a minimum length of hospital stay for maternity care, provisions currently under consideration permit physicians and patients to determine length of stay for breast cancer surgeries. Some also require coverage of reconstruction after mastectomy.

• Requirements for public disclosure of MCO terms and coverage—These inform consumers about MCO benefits coverage, limitations, and sometimes utilization review procedures at the time of enrollment in the MCO.

Utilization Management

Another target of managed care regulation is MCOs' utilization management (UM). UM techniques include the procedures required to access covered benefits, how service delivery is reviewed and controlled, and how enrollees may appeal coverage denials. MCOs use a much broader range of UM strategies than indemnity insurers, often including gatekeepers—primary care physicians (PCPs) who act as case managers and determine when enrollees should be referred for specialist care. Other UM techniques include requiring preauthorization for expensive procedures or care, reviewing services for medical necessity, requiring adherence to standard treatment protocols, and setting organizationwide targets for service utilization.

Such UM techniques help MCOs reduce costs by limiting the inappropriate use of services, but opponents note that these rules restrict enrollee access to specialist services. For their part, providers often feel that MCOs' management of care conflicts with their own autonomy, especially if they feel that MCO guidelines represent an inadequate level of care. Some physicians have charged that MCOs have forbidden the discussion of uncovered treatment options with patients, but a U.S. General Accounting Office (GAO) report found no such "gag" clauses in the contracts it reviewed (GAO 1997b). Another issue is whether MCOs should be able to determine medical necessity, as they often do now under insurance contracts, or whether an external standard should be imposed, such as "accepted medical practice."

Policymakers want to ensure that MCOs do not act arbitrarily in denying services and that enrollees have recourse if benefits are inappropriately delayed or denied. Proposals addressing concerns about care management techniques cover a broad range of provisions, including the following:

• Noninterference rules—These provisions prohibit MCOs from arbitrarily interfering with or altering the treating physician's decisions if ordered services are "medically necessary," a standard of coverage that is normally determined by the MCO.

• Explicit definitions of medical necessity—Some managed care regulation defines medical necessity as being determined by accepted medical practice. Some construe these definitions to give attending physicians the power to decide what is medically necessary, rather than MCOs.

• Bans on gag clauses—These disallow contract clauses that restrict physicians' discussions of all medically appropriate treatment options, including uncovered options, with enrollees.

• Within-MCO access provisions—These allow enrollees in gatekeeper MCOs to visit specialists without obtaining a referral from a PCP first. Variations of these laws allow patients to designate a specialist as a PCP or to create "standing referrals," which permit patients with qualifying conditions to receive ongoing treatment from a specialist.

• MCO liability—This grants enrollees the right to sue their MCOs for personal injury due to coverage denials or other MCO decisions. Variations of this provision include malpractice liability reform and bans on requirements in physician contracts that MCOs be "held harmless" in any tort action.

• Enrollee appeals processes—These require MCOs to permit enrollees to appeal coverage decisions, often both within the organization and to an independent external reviewer, whose recommendations may or may not be binding on the parties. Appeals processes may also set timelines for coverage decisions.

• Access to medical records and confidentiality—These provisions require MCOs to have procedures for protecting the confidentiality of patient records. Some include procedures to allow patients to amend their medical files. Laws vary in specificity.

• Prohibitions on genetic discrimination—MCOs may not require enrollees to reveal genetic information or use genetic information for underwriting purposes.

• Formulary opt-out—This creates a procedure whereby patients can obtain drugs that are not on the MCO formulary if a nonformulary drug is medically appropriate.

• Utilization review requirements—These set rules for internal utilization management procedures, often requiring that physicians be involved in setting all protocols/policies.

• Quality assurance requirements—These require the establishment of internal quality assurance and improvement processes. Sometimes reporting requirements are included.

Many other UM provisions are less prevalent or less directly relevant to patient care. Examples include written policies for advance directives or organ donation or timelines for provider payment. Still other measures duplicate or amplify existing law, such as requirements for MCO solvency and certification or provider credentialing.

Financial Incentives

Some observers advocate regulation because managed care relies on financial incentives to patients and providers to encourage cost-effective behavior. For example, MCOs often charge enrollees a copayment for services or pay lesser amounts for out-of-network services. Some provisions restrict MCO payment differentials for out-of-network care or prohibit enrollee penalties for using other services, such as direct specialist access or ER care.

More consequential are the financial incentives that MCOs use to influence provider behavior. For example, most managed care organizations pay discounted fees to providers, as mentioned above. Some also use bonuses or "witholds" to reward success or penalize failure to meet utilization targets set by the MCO. Other MCOs use capitation, a flat per member per month fee, paid prospectively to providers to cover some or all services to enrollees. All of these incentives put providers at some risk for high costs, which encourages them to moderate utilization, specialist referrals, or both. These incentives thus save money for MCOs and insurance consumers but raise concern that physicians may sometimes sacrifice quality of care to protect themselves financially.

Policymakers have enacted or considered a range of measures to address financial incentives in MCOs, including the following:

• Bans on the use of provider financial incentives—These prohibit MCOs from using specified (sometimes called " improper") financial incentives to encourage physicians to delay or deny services.

• Bans on gag clauses regarding financial aspects of MCOs—These prevent MCOs from requiring that physicians not discuss the incentive structure of the MCOs with patients.

• Public disclosure of financial incentives—This requires MCOs to inform consumers of the financial incentives used by the MCO at the time of enrollment or prohibits MCOs from preventing physicians from discussing financial incentives.

• Prohibition of the use of enrollee financial incentives—These are usually tied to other patient protections. For example, "direct access" provisions typically permit no penalties for taking advantage of direct access to specialists.

Federal Responses

The federal government has taken action to regulate managed care through executive and legislative action. The President's Advisory Commission on Consumer Protection and Quality in the Health Care Industry recommended a national Patients' Bill of Rights in November 1997, which included disclosure, access to emergency care, enrollee grievance and appeals processes, confidentiality of medical records, patient participation in treatment decisions, and choice of providers and insurers (Advisory Commission 1997, Stauffer 1999a). The president required all federal health plans to implement the commission's recommendations. These include the Medicare and Medicaid programs (although these programs were already substantially in compliance with the commission's standards), the FEHBP, the Indian Health Service, the Department of Defense Military Health Program, and the Veterans' Health Program (White House 1998). Together, these federal health programs cover an estimated 85 million Americans. In addition, the Department of Labor (DOL) was instructed to use its limited authority under ERISA to require private employee benefit plans, both self- and fully insured, to disclose adequate information and to strengthen MCOs' internal appeals processes (White House 1998). These ERISA-governed group plans are believed to cover 125 million Americans. Among ERISA plans, those that self-insure are not subject to any state insurance regulation. Sources suggest that self-insured employer benefits plans cover 48 million people in the United States (BNA 1999b).

In the legislative arena, the Balanced Budget Act of 1997 codified patient protection measures for Medicare and Medicaid clients. Implementing regulations were proposed in September 1998, but final regulations have not yet been promulgated. Congress also has debated managed care consumer protection requirements for private populations. Some single-issue laws have been enacted, including a mandated length of stay for childbirth, but none of the more comprehensive consumer protection proposals have been enacted to date.

Pending Federal Proposals

Among the comprehensive federal patient protection proposals now under consideration (see table 1), there are four front-runners:

• A Democratic measure that takes the same form in both the House and the Senate (H.R. 358—sponsored by Rep. John Dingell; S. 6—Sen. Thomas Daschle),

• A bipartisan Senate bill (S. 374—Sens. John Chafee and Robert Graham),

• A House Republican bill (H.R. 448—Rep. Michael Bilirakis), and

• A Senate Republican bill (S. 326—Sen. James Jeffords). The Jeffords bill is the only one to have advanced past committee, on a party-line vote, as of March 1999 (BNA 1999b).

Application

One of the biggest differences in the Republican, Democratic, and bipartisan approaches is the population each seeks to protect (see table 2). The bipartisan and Democratic measures have the broadest application, regulating both private employer health benefits plans and health insurance issuers, for both group and individual policies. ("Issuers" are what states often call "carriers," that is, state-licensed insurers, including Blues plans and health maintenance organizations (HMOs).) These plans and issuers are estimated to cover about 160 million Americans (Carey 1998, BNA 1999b). The House Republican proposal has a slightly narrower application, regulating private employer group health benefits plans and their health insurance issuers, but not individual products, already subject to state law. The bill would cover about 125 million people (Carey 1998). Finally, the Senate Republican bill would have the narrowest application. Most of its provisions regulate only those employer benefits plans that self-insure (48 million people), but it does extend the rules for independent external review processes to the fully insured population (Carey 1998, BNA 1999a).²

All bills create a national minimum standard or floor, supplemented by existing state rules. The bills would not preempt state statutes unless the state laws conflict with the federal legislation. States could impose more stringent rules (though only for insured products, not for employee benefits plans). The Senate Republican bill, which primarily applies to self-insured employee benefits plans, does not raise any issues of preemption of state law since self-insured firms are not subject to state insurance regulation. One reason Senate Republicans sought to regulate only self-insured plans was to make it clear that only the federal government would enforce any federal patient protection standards (BNA 1999a).

Substantive Provisions

Table 3 lists the major patient protection provisions included in the four bills mentioned above.³ It also shows the number of states that have enacted similar provisions, according to various secondary sources. All of the bills provide access to the emergency room; disclosure of benefits, procedures, and provider and quality information; bans on gag clauses; direct access to obstetricians and gynecologists (OB-GYNs); internal appeals and independent external review processes; and bans on financially penalizing enrollees for taking advantage of specific protections. The bills differ in the general philosophy and range of other provisions, however. The Democratic bill takes the most restrictive approach, including controversial measures allowing enrollees to sue their MCOs or benefits plans (under limited circumstances), defining medical necessity, prohibitin "arbitrary" interference with physician decisions, and banning inappropriate financial incentives to physicians.

The Republican bills seek to avoid the more "costly mandates that could raise premiums and force people to lose coverage," mentioned above (BNA 1999b). Nor do they ban any prohibition of discussions of financial incentives between physicians and patients. They do allow patients to access and amend their medical records, a provision not seen in the bipartisan and Democratic bills. Beyond these commonalities, however, the two Republican bills are quite different from each other. The House bill, sponsored by Rep. Bilirakis, does not include the measures for continuity of care, confidentiality, or disclosure of physician financial incentives that are part of the Jeffords bill. The House bill does include a unique section creating new standards for health care liability lawsuits but no new ability to sue. The Senate Republican bill is the only one that prohibits issuers and plans from using genetic information to set premiums or exclude individuals from coverage.

The bipartisan bill seeks the middle ground: it duplicates most of the provisions in the Democratic bill, but importantly omits the enrollee right to sue plans or issuers, strongly opposed by Republicans, and includes direct access to pediatricians, strongly favored by Republicans. Oddly, while all three other bills require the offer of a POS option, the bipartisan bill does not. It also includes a provision not seen in other bills, protecting the mentally ill from involuntary disenrollment based on uncontrollable or abusive behavior.

Even where all the bills include the same provisions, however, the Democratic, Republican, and bipartisan approaches are often quite different in the details. For example, all grant enrollees the right to appeal plan coverage decisions to an independent external reviewer. Republican bills allow health plans to choose the reviewers, while the Democratic and bipartisan bills require external reviewers to be certified by the state or a federal Department of Health and Human Services secretary (DHHS), DOL, or Treasury. The Democratic bill allows appeals of any grievance, while the Republican measures permit review only of denials based on medical necessity or experimental treatment. Both Republican bills also constrain the evidence that outside reviewers may consider on appeal. The Senate bill has been amended to allow external reviewers to review the medical evidence of patients and physicians in addition to a plan's clinical practice guidelines, but it does not allow complete de novo review of the entire case, as in the Democratic bill (BNA 1999b). The House Republican bill, unlike the other bills, requires the enrollee to pay for the review but does not require employee benefits plans or health insurance issuers to follow the reviewer's recommendations.⁴ In contrast, the Democratic and bipartisan measures require the health plan or issuer to pay the costs of the process. In short, even where bills have the same provisions, the specifics differ enormously.

If no agreement can be reached on a comprehensive bill, one possible compromise would be a "lean" bill embodying the most broadly accepted provisions—those that do not greatly raise costs or challenge the most fundamental aspects of managed care. Such compromises have helped states break legislative deadlocks over controversial provisions such as the right to sue, sweeping prohibitions of financial incentives, or broad requirements of clinical autonomy over what constitues "medically necessary" care (AHL 1999). Last year's House Republican bill (H.R. 4250), the only bill to pass either chamber, may hint at what a successful compromise bill could include: mandatory offer of a POS option, disclosure requirements, a ban on gag clauses, access to emergency room care, continuity-of-care provisions for pregnant women, standards for internal appeals, provisions for independent external appeals, and medical record confidentiality rules.

What Federal Legislation Means for States

The legal application and content of federal bills just discussed are very important in understanding how any enactment would affect the states. Practical impacts in any given state also depend on how many residents are in managed care but have little or no patient protection under existing state or federal rules. This section addresses state-by-state variations in impact depending on the size of each state's affected populations and the extent of existing state protections. The 13 ANF focus states⁵ illustrate the wide variation in both these factors.

Size of the Affected Population

Some residents in every state are already covered by managed care consumer protections under federal government-sponsored health plans. Also, in some states, only a small percentage of the population is covered by self-insured health benefits plans, expanding the reach of any existing state regulation. The importance of federal patient protection legislation depends in part on how many people in the state are enrolled in managed care plans, the target of most patient protection standards. So in a given state, the number of people affected by new federal legislation would depend in part on the extent of coverage in federal plans, self-insurance, and managed care penetration.

Federal plan coverage

A substantial portion of people in every state are already covered by patient protection requirements under federal health programs. Medicare, FEHBP, and military and veterans' programs insure about 15 to 20 percent of residents in each of the 13 focus states (U.S. Bureau of the Census 1998).⁶ There is even greater variation across the 13 focus states in Medicaid enrollment, ranging from 5.9 to 18.1 percent of the nonelderly population in Colorado and California, respectively (Liska et al. 1998).

Self-insurance

The fewest legal protections apply to the self-insured, so it is of great interest to know the extent of self-insurance by state. Unfortunately, there are no state-level estimates for the number of people covered by self-insured health benefits plans, but the figure surely varies by state.⁷

MCO penetration

A more measurable portion of the state population likely to be affected is the percentage covered by managed care organizations. Where few residents are served by MCOs, legislation limiting MCO practices would affect care for only those few. Note that low MCO penetration does not always correspond with low levels of state managed care regulation.

Table 4 shows the penetration of health maintenance organizations and preferred provider organizations (PPOs) in the 13 focus states.⁸ California, Colorado, and Minnesota have high rates of both HMO and PPO penetration relative to other focus states. Thus, these states would feel the largest impact of new federal managed care legislation, other things equal. The smallest impact would occur in states with relatively low enrollment in both HMOs and PPOs, like Mississippi and Michigan.

Several other states have high percentages in HMOs but not PPOs (such as Massachusetts) or vice versa (for example, Texas). Such disparity in penetration rates may occur where one type of health plan enjoys regulatory advantages or became entrenched before other plan types developed. New regulation will have considerable effects if it targets the type of managed care with the largest enrollment but only marginal effects if it targets a plan type with small statewide enrollment. Where regulations apply to all forms of health insurance, the impact on the state will still be influenced by managed care penetration, because managed care practices will be more widespread (even among traditional forms of insurance) where MCOs have high market share.

The specific requirements enacted will also be more relevant to some forms of health insurance than to others. In general, patient protection provisions would be expected to affect indemnity plans the least, HMOs the most, and PPOs somewhere in between; but this depends on the mix of controls used by a given MCO. For example, since there are no networks and no gatekeepers in indemnity insurance, provisions like direct access to specialists, the option to use out-of-network providers, and continuity of care would be irrelevant to indemnity carriers. Most PPOs do not use gatekeepers but do have a limited provider network, so some network restrictions would apply. However, PPOs already provide partial coverage for out-of-network services, so a mandated POS option would be superfluous. Mandated POS and continuity of care might be most onerous for staff-model HMOs, which rely on a relatively small, closed panel of physician employees. HMOs that capitate physician groups globally for all services might be little affected by UM restrictions but would have big problems with restrictions on financial incentives. To the extent that HMOs are most apt to use all of these types of controls, they would be most affected by patient protection regulation.

Existing State Regulation

The likely effect of federal patient protection legislation also depends on the extent to which states have already enacted similar statutes. Duplicative federal legislation would not make substantial changes. Indeed, if federal legislation delegates enforcement authority to states (as discussed below), nothing would change. The exceptions to this, of course, are that federal statutes may preempt conflicting state requirements and that they can protect more insured people than state regulation can. The provisions under consideration at the federal level were generally enacted first at the state level, so they tend to be similar to the managed care rules seen at the state level. However, the details of some provisions, such as the appeals timetable, often vary across states and between the states and the federal proposals.

Table 5 shows the key provisions in the 13 focus states and the total number of provisions each state has in force. The types and numbers of provisions enacted vary greatly across the selected states (this is also true for the rest of the states not shown here). A few provisions in proposed federal legislation would be totally new to every state because no state has them, including rules requiring direct access to pediatricians and noninterference with physician decisions. Other measures have been enacted in only a few states, including an enrollee right to sue health plans (Texas and Missouri), definitions of medical necessity (North Dakota, Georgia, and Texas), and access to clinical trials (Georgia, Maryland, and Rhode Island) (Stauffer 1999h, Families USA 1998). A few state measures would be wholly unaffected by the legislative proposals we studied because they have no federal counterpart, including AWP laws and others not included in Table 5. The four bills we studied would not make managed care regulation completely uniform across states but would generally create a floor of minimum standards.

Certain measures have been widely enacted across states. The ban on gag clauses has achieved near unanimity, even though in practice gag clauses appear to be rare (GAO 1997b). Other widely enacted measures are direct access to OB-GYNs, access to emergency services, and disclosure of plan information at the time of enrollment. These provisions may evince either the most widely shared fears about managed care or, alternatively, the simplest points of consensus.

Seven of the 13 states have high counts of managed care patient protection provisions.⁹ Texas, New York, and New Jersey have the largest number of restrictions, at 21, 18, and 17, respectively. Other things equal, these states would see the least impact from the federal legislation, although state law might have to be harmonized with specific provisions of federal law. Among the six focus states with low numbers of managed care provisions are Washington, Massachusetts, and Alabama, with only 5, 6, and 6 already in force. These states would see the greatest impact from a federal law.

Because of the split in regulatory authority over fully insured vs. self-insured employee benefits plans, after any federal enactment, protections for residents within any one state might be uniform or might still vary by insurance status. Under the Democratic and bipartisan federal bills, protections for a given state's residents would be uniform in states that previously had the same or fewer enacted protections, because the minimum floor of federal legislation would set a new state maximum. However, states with greater regulation would have two tiers of protection—more for residents with fully insured coverage regulated by the state and only the federal minimum for the self-insured. Under the Senate Republican approach, nearly every state would have different levels of protection for different populations, because existing state rules would continue for the fully insured, and probably somewhat different national federal rules would apply to the self-insured. State insurance regulators, through the National Association of Insurance Commissioners, have urged Congress not to interfere with existing state regulations or to impose national uniformity, arguing that states are responsive to their own conditions (Sebelius 1999). They are thus perceived as supporting the Jeffords bill or a similar Republican proposal (AMN 1999).

Intersection of Regulation and Penetration

The influences of managed care penetration and existing state regulation interact. High-penetration states with few existing provisions would be greatly affected by new federal law. In contrast, low-penetration states with more existing regulation would see little change for the fully insured population. Tables 6a and 6b plot the intersection of managed care regulation and managed care penetration among the 13 focus states. With regard to HMO enrollment, Texas would probably be least affected by federal legislation because it has relatively low HMO penetration but many patient protection measures. Among the 13 focus states, the greatest impact would theoretically come in Massachusetts, where HMO enrollment is relatively high and the number of provisions is low. Looking at PPO enrollment, Alabama would be likely to see the greatest impact from federal legislation, while New Jersey and New York would see little impact. As already mentioned, the extent of self- insurance would affect the calculus of practical impacts as well.

Implementation and Enforcement

The pending federal proposals take very different approaches to implementation and enforcement, which derive from the differences in the entities they target for regulation.¹⁰ Differences follow partisan lines, as they do for the substantive rules already discussed. All current proposals build on the prior federal assignment of responsibilities under the Health Insurance Portability and Availability Act of 1996 (HIPAA). As a group, the federal proposals make use of two ways to enforce new law—through administrative oversight and through the provision of legal remedies for aggrieved individuals.

Administrative Oversight

For administrative oversight, HIPAA established a hierarchy of shared responsibilities, both within the federal level and between federal and state enforcement authorities. Arrangements are complex and can only be sketched here.¹¹ Federal responsibilities are split between the Departments of Labor and of Health and Human Services, with a smaller role for the Treasury Department, mainly to enforce some tax penalties. All the departments collaborate to develop substantive regulations to implement HIPAA, but implementation is parceled out: DOL oversees ERISA plans, namely workplace-based group benefits plans run by employers or unions. DHHS covers issuers of coverage, that is, state-regulated insurers. For such insurance products, Congress intended states to play a major role, and HIPAA calls for DHHS to delegate responsibility for enforcement to states where their laws are consistent with HIPAA rules (some states had to enact conforming amendments). Where state rules fall short of HIPAA requirements, DHHS regulates issuers directly; as of this writing, direct DHHS regulation applies in five states.

The Senate Republica