Vermont Regulatory Action: A Reminder that Insurers Must Maintain Oversight of Their TPA and PBM Business Partners
The Vermont Department of Financial Regulation (the “Department”) recently took significant enforcement action against an insurer after determining that the insurer had violated various provisions of Vermont’s insurance laws, which included the insurer’s failure to adequately supervise its third party administrator (“TPA”) and pharmacy benefits manager (“PBM”) business partners. The regulatory action resulted in payments by the insurer exceeding $1.8mil, mandatory changes to the insurer’s control systems, and required reports to the Department on an ongoing basis.
The regulatory action arose out of a market conduct examination by the Department targeting certain of the insurer’s health plans that were sold in Vermont over the course of several years. The examination revealed multiple violations of Vermont’s insurance laws, including use of potentially misleading marketing materials and unapproved policy forms, failure to provide certain coverages mandated by state and federal law, failure to maintain adequate complaint procedures, failure to file annual complaint reports and improper denial of claims. The Department noted that the insurer often used TPAs and PBMs to carry out the activities (e.g., marketing, sales, policy administration, claims handling and claims adjudication) that led to many of the alleged violations.
In the course of its examination, the Department also determined that the insurer did not maintain sufficient records to allow the Department to reconstruct claim activities or to demonstrate that the insurer exercised adequate oversight of its TPA and PBM business partners. Additionally, the Department determined that the insurer failed to confirm that one of its PBM business partners was properly registered in Vermont before doing business with that PBM. As a result of the various alleged violations of law which were discovered during the examination, the Department found that the insurer did not adequately supervise the actions of its TPA and PBM business partners in violation of 18 V.S.A. § 9472 and Department Regulation H-2009-03. The Department also concluded that the insurer was responsible for the acts of its contracted TPAs and PBMs under common law principles of agency as defined by Vermont case law.
Following the examination, the Department entered into a Stipulation and Consent Order (the Order) with the insurer. The Order required the insurer to make payments in an amount that exceeded $1.8mil. That figure includes a $950,000 administrative penalty, a $150,000 contribution to the Vermont Financial Services Education and Victim Restitution Fund, a $225,000 contribution to Vermont Legal Aid and $481,000 in reimbursements to insureds.
The Department also required the insurer to develop a “Corrective Action Plan” that included various mandatory elements. Some of the noteworthy elements in the Corrective Action Plan required the insurer to (1) create a robust internal compliance program; (2) enhance its capabilities to supervise its business partners, including strengthening contracts with those entities; (3) perform regular audits of its business partners and subsequently report any issues identified in the audits to the Department along with a plan for remedying those issues; (4) provide regular status updates to the Department regarding the resolution of issues identified during audits and compliance with the Corrective Action Plan more generally; and (5) compensate the Department for any expenses it incurs while reviewing the insurer’s compliance with the Corrective Action Plan.
To satisfy the requirements of the Corrective Action Plan, the insurer created two new business units – one tasked with improving internal control systems and the other tasked with improving business partner compliance – and staffed each with several full-time compliance professionals.
We have written before about the importance of insurers maintaining adequate oversight of TPAs and PBMs (relevant articles can be found on our Intelligence page linked here). Like the regulatory actions discussed in those prior articles, this action by the Vermont Department is a reminder of the significant regulatory consequences that can result when an insurer fails to properly supervise its TPA and PBM business partners.
Hawaii Insurance Department Establishes TPA Application Requirements
Recently enacted Hawaii Senate Bill (SB) 1212 imposes extensive licensing and regulatory requirements on third party administrators (TPAs) operating in that state. Beginning January 1, 2020, no individual or entity may act as or hold itself out to be a TPA in Hawaii without first obtaining a TPA license from the Hawaii Department of Commerce and Consumer Affairs (the Department). Any person that violates the TPA licensing requirements could be issued a cease and desist order and/or be fined between $100 to $10,000 per violation by the Department in addition to any other penalties permitted by law.
SB 1212 defines “administrator” or “third party administrator” as “a person who collects charges or premiums from, or who adjusts or settles claims on, residents of this State in connection with self-insurance, stop-loss, or life insurance coverage, accident and health or sickness insurance coverage, or article 1 of chapter 432 [regarding Mutual Benefit Societies].” The Department recently published guidance indicating that “TPA licensing requirements apply to both business entities and individuals.”
To obtain a TPA license, an applicant must submit a completed copy of the Department’s Third Party Administrator Checklist and Application along with the relevant filing fee, which ranges from $450 to $600. The TPA Checklist and Application require the following documents and information for all applicants:
1) Designation of resident or non-resident status.
2) The professional qualifications of the applicant’s principals. If the applicant is an individual, this requirement applies directly to the applicant.
3) Background information regarding criminal history, regulatory actions, financial issues, civil litigation and termination of business relationships.
4) Annual financial statements for the two most recent years (or such shorter period as the applicant has been in existence) that were prepared in accordance with GAAP and prove the applicant has a positive net worth.
5) A Hawaii surety bond in the amount of at least $100,000.
Business entity applicants must also submit (1) certain organizational documents, such as Articles of Incorporation, Bylaws, etc. and (2) background information for certain officers, directors, owners or their equivalents.
The Department began accepting applications on October 1, 2019, and all persons must be licensed before operating in Hawaii after the effective date of the law. Once licensed, each TPA must comply with certain ongoing operational and reporting requirements. Depending on the scope of a TPA’s activities and certain other factors, the TPA and/or its employees may also need to be licensed as producers or adjusters in Hawaii.
Life Lines of Business Now Trigger Maryland’s TPA Laws
Beginning October 1, 2019, entities that administering life lines of business in Maryland are now subject to the TPA laws in that state. This change occurred due to the passage of Maryland’s Senate Bill (SB) 22, which expands the definition of “administrator” to mean:
a person that, to the extent that the person acting for an insurer or plan sponsor, has: (i) control over or custody of premiums, contributions, or any other money on behalf of a life insurer or with respect to a plan, for any period of time; or (ii) discretionary authority over the adjustment, payment, or settlement of benefit claims on behalf of a life insurer or under a plan or over the investment of a life insurer’s or a plan's assets.
SB 22 also expands the definition of “plan” to mean:
a fund or other arrangement that is established, maintained, or contributed to by an employer, employee organization, or both, to the extent that the fund or arrangement was established or is maintained for the purpose of: (i) providing for participants or beneficiaries, any of whom are residents of the State, through the purchase of insurance or otherwise:[1-9 various types of employer-sponsored benefits, including medical, accident, disability, vacation] . . .10. life insurance. . . .
As a result, entities that perform regulated services in connection with life lines of business are now required to register as TPAs with the Maryland Insurance Administration and are subject to numerous operational and reporting requirements. Please note that SB 22 also makes various conforming changes to Maryland’s TPA laws to account for the expanded definitions above.
Entities that fail to comply with Maryland’s TPA registration requirement could be fined up to $1000 per day and subjected to a range of other penalties. Violation of the TPA laws’ other requirements could result in a wide variety of consequences, such as a cease and desist order, fines up to $10,000 per violation, criminal penalties and/or any other penalty permitted by law.
Vermont Adopts Licensing and Regulatory Requirements for Administrators of HRAs, HSAs or FSAs
Vermont recently enacted Senate Bill (SB) 41, which grants the Commissioner of Financial Regulation (the Commissioner) jurisdiction over certain entities that administer one or more health reimbursement arrangements (HRAs), health savings accounts (HSAs), flexible spending accounts (FSAs), or similar tax-advantaged accounts for health-related expenses (all as defined under federal law). SB 41 does not apply to an employer that self-administers one or more tax-advantaged accounts on behalf of its own employees.
SB 41 directs the Commissioner to adopt regulations to license and regulate such entities by September 1, 2020. Such regulations are to include annual licensure/registration filing requirements and any other requirements the Commissioner deems necessary to protect Vermont consumers and employers. SB 41 sets annual licensing and renewal fees at $600.
SB 41 became effective June 10, 2019, but the Commissioner does not appear to have issued any corresponding regulations as of the publication of this article.Vermont does not otherwise license TPAs that administer life or accident and health business, other than the required registration with VHCures.
View the full newsletter here.