Friends, we’ve been busy lately. We’ve been attempting to control a dinosaur. In our office, we semi-affectionately named the federal RxDC reporting requirement Rex, whom we envision as a pesky green tyrannosaurus. For the past two months, we’ve been controlling Rex for our friends by helping employers complete their D1 RxDC filings before the June 1, 2023, deadline.
After weeks of working with an endless stream of employer groups on this new reporting obligation, we’ve learned a few things, some more surprising than others. Our families assure us that none of these fun facts are interesting to anyone besides us, but we feel our friends might feel otherwise!
- Employers “Own” the D1 Data. Carriers, TPAs, and PBMs could submit D2-D8 RxDC files for their group plan sponsor clients. Those files are all about claims paid by plans, which is data they have on hand. However, D1 files require detailed information about how money and participants flow into each plan. This information isn’t what carriers, TPAs, and PBMs otherwise maintain. As RxDC reporting came into the picture, many vendors were willing to collect this data from their clients and file D1s (usually if the client adhered to a strict deadline), but some could not. As a reminder, CMS did not generally require the “employer” information on the D1 to be included in the 2020 and 2021 RxDC filings completed last winter.
- The CMS HIOS System Isn’t “Employer Friendly.” The federal government did not make the RxDC filing process easy for employers who needed to DIY their D1 filings—although, admittedly, efforts were made to make it easier over time. HIOS, the system for RxDC file submission, is challenging to use. It takes ages to get credentialed since the process involves eight distinct steps that take many days to complete. The average amount of time to obtain permission to be able to submit is two weeks, and many employers reported to us that it was taking them even longer. Credentialing also requires submitting personally identifiable information (including SSNs).
- HIOS wasn’t intended to be used by individual employers. Once an employer gets HIOS credentialed, they must follow tricky directions and adhere to persnickety data formatting requirements. Sometimes it’s just easier to reach out to a friend for help…
- Coordination of data is likely to be a significant issue. CMS guidance anticipated that most of the data submitted through the RxDC process would be in aggregate format. Their guidance anticipated the ability to “match” this data by state, market segment, PBM, and carrier/TPA in a manner that would allow them to meaningfully piece together the relevant data in the D1-D8 files for common populations of plan participants. Considering the level of discoordination currently in the marketplace, it seems this will be daunting, if not impossible.
- Compliance with plan documentation requirements remains a significant issue. A stunning number of employer-sponsored health plans need appropriate ERISA plan documents. We already knew this, but helping groups of all sizes, shapes, and funding complete their D1 filings hit the point home. One big tip-off? When an employer had no idea what their plan’s formal name might be. When we refer to wraps, dear friends, we do not mean our favorite 90s Hip Hip songs. We save our talk of rap (and our dancing) for when we need to embarrass our children.
- CMS can determine if an employer group does not file a D1. If a group plan’s carrier or TPA and PBM submits D2-D8 files on a group client’s behalf, the accompanying P2 will list that employer plan. So, eventually, CMS will be able to tell which group health plans had D2-D8 files submitted but did not submit D1 data. It may take CMS a long time to get through all the data they received and make such a list, but when they are ready, it will be very apparent which group health plan sponsors completed their entire RxDC reporting obligations and which did not.
- We don’t know what RxDC reporting enforcement will look like. CMS officials have been clear that there is no good faith compliance standard concerning RxDC reporting. On their technical guidance webinars, CMS has also stated that they do not know what enforcement will look like. In a discussion we found particularly confounding, the technical officials noted a rumor about potential $100/person/day penalties for failure to complete this reporting. On this point, we mention that this is likely not a story as much as the result of compliance experts noting that the IRS has the authority to impose a $100/person/day excise tax on noncompliant group health plans.
- The June 1, 2023, submission deadline has passed, but CMS is still accepting filings through at least June 15, 2023, or maybe even longer. As long as they take submissions, MZQ will be here to help you. After all, that’s what friends are for.
