2024-01: OIC’s Interpretation of Chap. 48.200 RCW & RCW 48.43.731 – Health care benefit managers

MIKE KREIDLER STATE OF WASHINGTON Phone: 360-725-7000 STATE INSURANCE COMMISSIONER www.insurance.wa.gov

OFFICE OF INSURANCE COMMISSIONER

ICE OF THE CODE REVISER ST ATE OF WA SHINGTON FILED

DATE: April 16, 2024 TIME: 1:22 PM

WSR 24-09-069

Technical Assistance Advisory 2024-011

TO: Health Carriers

FROM: Insurance Commissioner Mike Kreidler

DATE: April 16, 2024

SUBJECT: OIC’s Interpretation of Chap. 48.200 RCW & RCW 48.43.731 – Health care benefit managers

The purpose of this Technical Assistance Advisory (“TAA”) is to provide guidance to health carriers2 on the Office of Insurance Commissioner (“OIC”)’s response to the Change Healthcare cybersecurity event that occurred on February 21, 2024, and the duties of health carriers and health care benefit managers under Chap. 48.200 RCW and Chap. 284-180 WAC.

Background

The Legislature enacted Chap. 48.200 RCW in 2020, with the express intent to protect and promote the health, safety, and welfare of Washington residents by establishing standards for regulatory oversight of health care benefit managers.3 In enacting the law, the Legislature explicitly found that:

“[G]rowth in managed health care systems has shifted substantial authority over health care decisions from providers and patients to health carriers and health care benefit managers. Health care benefit managers acting as intermediaries between carriers, health care providers, and patients exercise broad discretion to affect health care services recommended and delivered by providers and the health care choices of patients. Regularly, these health care benefit managers are

1 This advisory is a policy statement released to advise the public of OIC’s current opinions, approaches, and likely courses of action. It is advisory only. RCW 34.05.230(1).

2 See RCW 48.43.005 (defining “health carrier”). 3 RCW 48.200.010

Mailing Address: PO Box 40255 Olympia, WA 98504-0255 Street Address: 5000 Capitol Blvd Tumwater WA 98501 OFFICE OF THE INSURANCE COMMISSIONER

Technical Assistance Advisory 2024-01 Change Healthcare Response April 16, 2024 Page 2

making health care decisions on behalf of carriers. However, unlike carriers, health care benefit managers are not currently regulated.”

Health care benefit manager registration went into effect in Washington State on January 1, 2022.

Change Healthcare experienced a cybersecurity event on February 21, 2024. On March 18, 2024, OIC sent a letter to each health carrier operating in Washington state requesting copies of all executed and active health care benefit manager contracts with Change Healthcare, Inc., Change Healthcare Pharmacy Solutions, Inc., and any other Change Healthcare affiliate as required by current law. The due date for submission of contracts was April 6, 2024. On April 10, 2024, OIC sent a series of follow-up letters to health carriers once again requiring carriers to submit any health care benefit manager contracts with Change Healthcare, Inc., Change Healthcare Pharmacy Solutions, Inc., and any other Change Healthcare affiliate. The health carriers’ responses to the second letter are due to OIC on April 20, 2024.

On March 18, 2024, OIC also sent a letter to Change Healthcare, Inc. requesting copies of executed and active health care benefit manager contracts with each licensed health carrier for which Change Healthcare, Inc. performs any services described in RCW 48.200.020. Change Healthcare responded to that request as follows:

“Change Healthcare Pharmacy Solutions, Inc. is not contracted with a licensed health carrier, as that term is defined by RCW 48.43.005. Change Healthcare Pharmacy Solutions Inc. does not perform health care services, as defined in RCW 48.43.005, to any licensed health carrier. Therefore, we do not have any executed or active health care benefit manager contracts to send.”

The OIC has determined that Change Healthcare, and other business entities, are intricately involved in the claims processing and utilization review functions of several Washington state registered or authorized health carriers. However, there appears to be confusion regarding compliance obligations under Chapter 48.200 RCW among some entities whose activities indirectly impact claims processing, utilization review and other services that affect utilization of benefits and patient access to health care services in the Washington health care marketplace. Similarly, there also appears to be confusion among health carriers regarding their obligations and liability under the Insurance Code, Title 48 RCW, with respect to entities with whom they directly or indirectly contract to provide health care benefit management services, including claims processing and utilization review. The OIC is issuing this TAA to advise health carriers and health care benefit managers of the plain language of Chap. 48.200 RCW and RCW 48.43.731 related to the duty of health care benefit managers to register as a condition of conducting business in Washington state and the duty of both health care benefit managers and health carriers to submit direct and indirect contracts for health care benefit management services to the OIC.

A. Only Registered Health Care Benefit Managers May Provide Services that Directly or Indirectly Impact the Determination or Utilization of Benefits for, or Patient Access to, Health Care Services on Behalf of Health Carriers. OFFICE OF THE INSURANCE COMMISSIONER

Technical Assistance Advisory 2024-01 Change Healthcare Response April 16, 2024 Page 3

RCW 48.200.020(4)(a) defines “health care benefit manager” as a person or entity providing services to, or acting on behalf of, a health carrier or employee benefits programs, that directly or indirectly impacts the determination or utilization of benefits for, or patient access to, health care services, drugs, and supplies including, but not limited to:

(i) Prior authorization or preauthorization of benefits or care; (ii) Certification of benefits or care; (iii) Medical necessity determinations; (iv) Utilization review; (v) Benefit determinations; (vi) Claims processing and repricing for services and procedures; (vii) Outcome management; (viii) Provider credentialing and recredentialing; (ix) Payment or authorization of payment to providers and facilities for services or procedures; (x) Dispute resolution, grievances, or appeals relating to determinations or utilization of benefits; (xi) Provider network management; or (xii) Disease management. (emphasis added)

In addition, RCW 48.200.020(4)(b) notes that "Health care benefit manager" includes, but is not limited to, health care benefit managers that specialize in specific types of health care benefit management such as pharmacy benefit managers, radiology benefit managers, laboratory benefit managers, and mental health benefit managers. With respect to use of the term “including but not limited to,” it is clear that the list of health care benefit management services included in RCW 48.200.020(4) is - not - exclusive. The operative language of the definition is whether an entity is providing services that directly or indirectly impact the determination or utilization of benefits for, or patient access to, health care services, drugs, and supplies. The Legislature wisely determined that given changing and evolving business practices, an exclusive list of health care benefit management services would risk becoming outdated following enactment. However, for services such as “claims processing” and “utilization review,” which are explicitly set forth in statute, there is no question that these services were included in the types of services the Legislature believed could be offered directly or indirectly by a health care benefit manager.

RCW 48.200.030 provides that to conduct business in the state of Washington, any entity satisfying the definition of a health care benefit manager in RCW 48.200.020(4) must register with the Commissioner and annually renew their registration. WAC 284-180-220 through -240 address health care benefit manager initial registration and renewal processes.

RCW 48.200.040(1) prohibits a health care benefit manager from providing health care benefit management services to a health carrier or employee benefits programs without a written agreement OFFICE OF THE INSURANCE COMMISSIONER

Technical Assistance Advisory 2024-01 Change Healthcare Response April 16, 2024 Page 4

describing the rights and responsibilities of the parties conforming to the provisions of chapter 48.200 RCW and any rules adopted by OIC to implement or enforce that chapter, including rules governing contract content. Further, RCW 48.200.040(2) requires that health care benefit managers file “every benefit management contract and contract amendment between the health care benefit manager and a health carrier, provider, pharmacy, pharmacy services administration organization, or other health care benefit manager, entered into directly or indirectly in support of a contract with a carrier or employee benefits programs, within 30 days following the effective date of the contract or contract amendment.”4

Under the plain language of RCW 48.200.020 through RCW 48.200.040, whenever an entity offers services that directly or indirectly impact the determination or utilization of benefits for, or patient access to, health care services, drugs, and supplies, that entity is acting as a health care benefit manager that must be registered with the OIC as such.5 This includes entities that directly or indirectly contract with health carriers for the provision of health care benefit management services, including claims processing and utilization review.

B. All Contracts with Entities that Should Be Registered as Healthcare Benefit Managers Must be Submitted to the OIC by both the Health Carrier and any Health Care Benefit Manager.

RCW 48.43.731 sets out requirements for health carriers to file with OIC every contract and contract amendment between the carrier and a health care benefit manager within thirty days following the effective date of the contract or contract amendment.

Further, as noted above, RCW 48.200.040(2) requires that health care benefit managers themselves file “every” benefit management contract and amendment between themselves and any health carrier, provider, pharmacy, pharmacy services administration organization, or other health care benefit manager, that directly or indirectly supports a contract with a carrier or employee benefits programs.

The plain meaning of the phrase “directly or indirectly” as used in RCW 48.200.040(2) encompasses arrangements under which a carrier contracts with an intermediary entity who then subcontracts for health care benefit management services. To ignore this language would provide an opportunity for both health carriers and health care benefit managers to evade the intent and purpose of the law by continuing to allow unregulated entities to make critical decisions that affect utilization of benefits and patient access to health care services on behalf of carriers, with no oversight by regulators, and no transparency to consumers.

A failure by a health care benefit manager to register with the OIC does not excuse a health carrier

4 See also WAC 284-180-455 and WAC 284-180-460 5 There are several exceptions to the registration requirement for health care benefit managers that apply to specific types of entities. Entities that believe they are exempt from the requirements to register should refer to RCW 48.200.020(4)(c) to determine if they are a type of entity that falls outside of the definition of health care benefit manager. OFFICE OF THE INSURANCE COMMISSIONER

Technical Assistance Advisory 2024-01 Change Healthcare Response April 16, 2024 Page 5

from its responsibilities under the Insurance Code. In fact, under RCW 48.200.050, a health carrier can be held responsible for violations of the Insurance Code (Title 48 RCW) committed by any health care benefit manager with whom they directly or indirectly contract concerning the coverage of, payment for, or provision of health care benefits, services, drugs, and supplies.6 While these categories are not unlimited, there is little question that claims processing and utilization review activities fall within the categories of coverage, payment, and provision of health care benefits. Therefore, health carriers who choose to contract, directly or indirectly, with health care benefit managers that have failed to comply with the requirements of Chapter 48.200 RCW, may themselves be liable for any failings of the health care benefit manager with respect to the provision of any health care benefit management services, including the processing of claims or utilization review.

C. Conclusion

The plain language of Chapter 48.200 RCW requires that entities who directly or indirectly provide services that affect utilization of benefits and patient access to health care services, including but not limited to, claims processing and utilization review, register with the OIC as health care benefit managers. Further, all contracts to directly or indirectly provide such services on behalf of a Washington registered or authorized health carrier, including claim processing services, must be provided to the OIC.

The OIC has identified multiple entities, including those listed below, as contracting to provide health care benefit management services as corporate partners or affiliates of Change Healthcare:

• EquiClaim

• RelayHealth

• Emdeon

• Optum Rx

• OptumInsight

6 RCW 48.200.050(5) provides: “Health carriers and employee benefits programs are responsible for the compliance of any person or organization acting directly or indirectly on behalf of or at the direction of the carrier or program, or acting pursuant to carrier or program standards or requirements concerning the coverage of, payment for, or provision of health care benefits, services, drugs, and supplies. (b) A carrier or program contracting with a health care benefit manager is responsible for the health care benefit manager's violations of this chapter, including a health care benefit manager's failure to produce records requested or required by the commissioner. (c) No carrier or program may offer as a defense to a violation of any provision of this chapter that the violation arose from the act or omission of a health care benefit manager, or other person acting on behalf of or at the direction of the carrier or program, rather than from the direct act or omission of the carrier or program (emphasis added). OFFICE OF THE INSURANCE COMMISSIONER

Technical Assistance Advisory 2024-01 Change Healthcare Response April 16, 2024 Page 6

• McKesson

Any entity, including those listed above, that directly or indirectly contracts with a Washington registered or authorized health carrier to provide services that affect utilization of benefits and patient access to health care services, is required by law to register as a health care service contractor with the OIC. All contracts with any Washington registered or authorized health carrier must be filed with the OIC by the health care benefit manager.

Similarly, all Washington registered or authorized health carriers that have direct or indirect contracts with any of the entities listed above, or others, to provide health care benefit management services, including claim processing and utilization review, are required to provide those contracts to the OIC. The OIC is actively reviewing submitted filings and responses to its inquiries to determine what additional steps may be necessary to ensure full compliance with the plain language and clear legislative intent of Chapter 48.200 RCW.

Please direct any questions about this advisory to Jennifer Kreitler, who may be contacted at Jennifer.Kreitler@oic.wa.gov or by phone at 360-725-7127.