The Health Insurance Portability and Accountability Act: more than we bargained for, and less.

• Author: Miller, Tom

When Congress passed the Health Insurance Portability and Accountability Act (HIPAA) in 1996, the legislation was marketed as a modest attempt to address health insurance portability problems facing insured workers who wanted to change jobs. So-called job-lock concerns involved workers who were worried about losing or being denied access to insurance due to their health status and therefore remained in existing jobs that provided group health insurance to them and their dependents.

Today, the bill's sponsors have good reason to be modest about its portability achievements: HIPAA provided little, if any, help to vulnerable consumers seeking more affordable health insurance options. It did create a false sense of security that lulled many buyers into getting less value for their insurance dollar. HIPAA tried to lock an outdated, employer-based insurance market structure into place. It stifled promising market innovations such as medical savings accounts (MSAs). Most recently, it has confronted proposed defined contribution health plans with legal uncertainties about how they might be regulated.

Meanwhile, the accountability side of HIPAA launched an expansion of the federal government's role in controlling private health arrangements and reversed decades of regulatory deference to the states. Its vague statutory language set in motion a nearly incomprehensible maze of federal health privacy regulations that promised little in the way of effective privacy protection, yet imposed extraordinary compliance burdens. The HIPAA "privacy" regulations issued in April 2001 and modified slightly in March 2002 actually granted government officials greater access to personal health information.

HIPAA also sought to lower health care costs by reducing "fraud and abuse." It incorporated a number of the 1993 Clinton health plan's proposed criminal and civil sanctions against physicians and other health care providers. HIPAA federalized health fraud law, stiffened penalties, ramped up spending committed to fraud control, and stimulated an unprecedented number of enforcement actions. Instead of improving prepayment claims review processes in federal health programs, it used the threat of severe sanctions to criminalize billing disputes and coerce discounts after the fact.

When HIPAA came before Congress, members were eager to gain credit for positive health care accomplishments that would not appear to cost taxpayers any money and did not threaten to overhaul the entire health care system. Relatively minor health insurance regulatory reforms that addressed the anxieties of middle-class voters offered a politically popular fix. So HIPAA was sold with the promise that it would reduce job lock by restricting preexisting condition exclusions or other "health status" discrimination that might otherwise jeopardize insurance coverage...