WSR 24-09-069

OFFICE OF THE

INSURANCE COMMISSIONER

[Filed April 16, 2024, 1:22 p.m.]

The purpose of this technical assistance advisory (TAA) is to provide guidance to health carriers2 on OIC's response to the Change Healthcare cybersecurity event that occurred on February 21, 2024, and the duties of health carriers and health care benefit managers under chapter 48.200 RCW and chapter 284-180 WAC.

Background: The legislature enacted chapter 48.200 RCW in 2020, with the express intent to protect and promote the health, safety, and welfare of Washington residents by establishing standards for regulatory oversight of health care benefit managers.3 In enacting the law, the legislature explicitly found that:

"[G]rowth in managed health care systems has shifted substantial authority over health care decisions from providers and patients to health carriers and health care benefit managers. Health care benefit managers acting as intermediaries between carriers, health care providers, and patients exercise broad discretion to affect health care services recommended and delivered by providers and the health care choices of patients. Regularly, these health care benefit managers are making health care decisions on behalf of carriers. However, unlike carriers, health care benefit managers are not currently regulated."

Health care benefit manager registration went into effect in Washington state on January 1, 2022.

Change Healthcare experienced a cybersecurity event on February 21, 2024. On March 18, 2024, OIC sent a letter to each health carrier operating in Washington state requesting copies of all executed and active health care benefit manager contracts with Change Healthcare, Inc., Change Healthcare Pharmacy Solutions, Inc., and any other Change Healthcare affiliate as required by current law. The due date for submission of contracts was April 6, 2024. On April 10, 2024, OIC sent a series of follow-up letters to health carriers once again requiring carriers to submit any health care benefit manager contracts with Change Healthcare, Inc., Change Healthcare Pharmacy Solutions, Inc., and any other Change Healthcare affiliate. The health carriers' responses to the second letter are due to OIC on April 20, 2024.

On March 18, 2024, OIC also sent a letter to Change Healthcare, Inc. requesting copies of executed and active health care benefit manager contracts with each licensed health carrier for which Change Healthcare, Inc. performs any services described in RCW 48.200.020. Change Healthcare responded to that request as follows:

"Change Healthcare Pharmacy Solutions, Inc. is not contracted with a licensed health carrier, as that term is defined by RCW 48.43.005. Change Healthcare Pharmacy Solutions Inc. does not perform health care services, as defined in RCW 48.43.005, to any licensed health carrier. Therefore, we do not have any executed or active health care benefit manager contracts to send."

OIC has determined that Change Healthcare, and other business entities, are intricately involved in the claims processing and utilization review functions of several Washington state registered or authorized health carriers. However, there appears to be confusion regarding compliance obligations under chapter 48.200 RCW among some entities whose activities indirectly impact claims processing, utilization review and other services that affect utilization of benefits and patient access to health care services in the Washington health care marketplace. Similarly, there also appears to be confusion among health carriers regarding their obligations and liability under the Insurance Code, Title 48 RCW, with respect to entities with whom they directly or indirectly contract to provide health care benefit management services, including claims processing and utilization review. OIC is issuing this TAA to advise health carriers and health care benefit managers of the plain language of chapter 48.200 RCW and RCW 48.43.731 related to the duty of health care benefit managers to register as a condition of conducting business in Washington state and the duty of both health care benefit managers and health carriers to submit direct and indirect contracts for health care benefit management services to OIC.

A. Only Registered Health Care Benefit Managers May Provide Services that Directly or Indirectly Impact the Determination or Utilization of Benefits for, or Patient Access to, Health Care Services on Behalf of Health Carriers: RCW 48.200.020 (4)(a) defines "health care benefit manager" as a person or entity providing services to, or acting on behalf of, a health carrier or employee benefits programs, that directly or indirectly impacts the determination or utilization of benefits for, or patient access to, health care services, drugs, and supplies including, but not limited to:

(i) Prior authorization or preauthorization of benefits or care;

(ii) Certification of benefits or care;

(iii) Medical necessity determinations;

(iv) Utilization review;

(v) Benefit determinations;

(vi) Claims processing and repricing for services and procedures;

(vii) Outcome management;

(viii) Provider credentialing and recredentialing;

(ix) Payment or authorization of payment to providers and facilities for services or procedures;

(x) Dispute resolution, grievances, or appeals relating to determinations or utilization of benefits;

(xi) Provider network management; or

(xii) Disease management.

(emphasis added)

In addition, RCW 48.200.020 (4)(b) notes that "Health care benefit manager" includes, but is not limited to, health care benefit managers that specialize in specific types of health care benefit management such as pharmacy benefit managers, radiology benefit managers, laboratory benefit managers, and mental health benefit managers. With respect to use of the term "including but not limited to," it is clear that the list of health care benefit management services included in RCW 48.200.020(4) is not exclusive. The operative language of the definition is whether an entity is providing services that directly or indirectly impact the determination or utilization of benefits for, or patient access to, health care services, drugs, and supplies. The legislature wisely determined that given changing and evolving business practices, an exclusive list of health care benefit management services would risk becoming outdated following enactment. However, for services such as "claims processing" and "utilization review," which are explicitly set forth in statute, there is no question that these services were included in the types of services the legislature believed could be offered directly or indirectly by a health care benefit manager.

RCW 48.200.030 provides that to conduct business in the state of Washington, any entity satisfying the definition of a health care benefit manager in RCW 48.200.020(4) must register with the commissioner and annually renew their registration. WAC 284-180-220 through 284-180-240 address health care benefit manager initial registration and renewal processes.

RCW 48.200.040(1) prohibits a health care benefit manager from providing health care benefit management services to a health carrier or employee benefits programs without a written agreement describing the rights and responsibilities of the parties conforming to the provisions of chapter 48.200 RCW and any rules adopted by OIC to implement or enforce that chapter, including rules governing contract content. Further, RCW 48.200.040(2) requires that health care benefit managers file "every benefit management contract and contract amendment between the health care benefit manager and a health carrier, provider, pharmacy, pharmacy services administration organization, or other health care benefit manager, entered into directly or indirectly in support of a contract with a carrier or employee benefits programs, within 30 days following the effective date of the contract or contract amendment."4

Under the plain language of RCW 48.200.020 through 48.200.040, whenever an entity offers services that directly or indirectly impact the determination or utilization of benefits for, or patient access to, health care services, drugs, and supplies, that entity is acting as a health care benefit manager that must be registered with OIC as such.5 This includes entities that directly or indirectly contract with health carriers for the provision of health care benefit management services, including claims processing and utilization review.

B. All Contracts with Entities That Should Be Registered as Healthcare Benefit Managers must be Submitted to OIC by Both the Health Carrier and any Health Care Benefit Manager: RCW 48.43.731 sets out requirements for health carriers to file with OIC every contract and contract amendment between the carrier and a health care benefit manager within 30 days following the effective date of the contract or contract amendment.

Further, as noted above, RCW 48.200.040(2) requires that health care benefit managers themselves file "every" benefit management contract and amendment between themselves and any health carrier, provider, pharmacy, pharmacy services administration organization, or other health care benefit manager, that directly or indirectly supports a contract with a carrier or employee benefits programs.

The plain meaning of the phrase "directly or indirectly" as used in RCW 48.200.040(2) encompasses arrangements under which a carrier contracts with an intermediary entity who then subcontracts for health care benefit management services. To ignore this language would provide an opportunity for both health carriers and health care benefit managers to evade the intent and purpose of the law by continuing to allow unregulated entities to make critical decisions that affect utilization of benefits and patient access to health care services on behalf of carriers, with no oversight by regulators, and no transparency to consumers.

A failure by a health care benefit manager to register with OIC does not excuse a health carrier from its responsibilities under the insurance code. In fact, under RCW 48.200.050, a health carrier can be held responsible for violations of the insurance code (Title 48 RCW) committed by any health care benefit manager with whom they directly or indirectlycontract concerning the coverage of, payment for, or provision of health care benefits, services, drugs, and supplies.6 While these categories are not unlimited, there is little question that claims processing and utilization review activities fall within the categories of coverage, payment, and provision of health care benefits. Therefore, health carriers who choose to contract, directly or indirectly, with health care benefit managers that have failed to comply with the requirements of chapter 48.200 RCW, may themselves be liable for any failings of the health care benefit manager with respect to the provision of any health care benefit management services, including the processing of claims or utilization review.

C. Conclusion: The plain language of chapter 48.200 RCW requires that entities who directly or indirectly provide services that affect utilization of benefits and patient access to health care services including, but not limited to, claims processing and utilization review, register with OIC as health care benefit managers. Further, all contracts to directly or indirectly provide such services on behalf of a Washington registered or authorized health carrier, including claim processing services, must be provided to OIC.

OIC has identified multiple entities, including those listed below, as contracting to provide health care benefit management services as corporate partners or affiliates of Change Healthcare:

Any entity, including those listed above, that directly or indirectly contracts with a Washington registered or authorized health carrier to provide services that affect utilization of benefits and patient access to health care services, is required by law to register as a health care service contractor with OIC. All contracts with any Washington registered or authorized health carrier must be filed with OIC by the health care benefit manager.

Similarly, all Washington registered or authorized health carriers that have direct or indirect contracts with any of the entities listed above, or others, to provide health care benefit management services, including claim processing and utilization review, are required to provide those contracts to OIC. OIC is actively reviewing submitted filings and responses to its inquiries to determine what additional steps may be necessary to ensure full compliance with the plain language and clear legislative intent of chapter 48.200 RCW.

Please direct any questions about this advisory to Jennifer Kreitler, who may be contacted at Jennifer.Kreitler@oic.wa.gov or by phone at 360-725-7127.