This government affairs update provided member firms with a comprehensive briefing on multiple active regulatory and legislative fronts including STLDI plan rules, non-compete developments, NYDFS cybersecurity regulation amendments, and other matters. The brief covered The Council's advocacy positions and actions on each issue. It demonstrated the breadth of regulatory activity impacting commercial insurance brokers across health, employment, and cyber domains.
Your Government Affairs team has been hard at work representing your interests at the state and federal level, while also keeping tabs on regulatory developments. Today, we have just a few more updates – some of which require your engagement – and we appreciate your attention.
Joel Kopperud
SVP, Government Affairs
Biden Administration Issues New Proposed Rule to Limit Short Term Health Plans
On Friday, July 7, the Departments of Labor, Health and Human Services, and Treasury (the Agencies) issued a Proposed Rule that would significantly reduce the term limits and allowable duration of short term, limited duration insurance (STLDI). Comments are due 60 days after publication in the Federal Register. The Council will be evaluating whether to submit comments and we encourage members to advise on any issues or concerns with the Proposed Rule that we should consider in our assessment.
The Proposed Rule would:
- Amend the federal definition for STLDI to require a specified expiration date of no more than 3 months after the original effective date and a maximum permitted duration of 4 months in total (accounting for renewals and extensions). This would apply to policies sold on or after the effective date.
- Explicitly states that payments from the employer to provide fixed indemnity plans are not excluded from the employee’s gross income if the amounts are paid without regard to the actual amount of medical expenses incurred, as well additional restrictions on how plans can be sold.
- Amend the current consumer notice requirements for both STLDI and Fixed Indemnity plans, revising both the content and formatting of the notice to promote better readability and comprehension. Notably, the Proposed Rule would add language to the notice that helps consumers identify how to enroll in comprehensive coverage, including links to reliable resources.
- Amend the federal definition for STLDI to require a specified expiration date of no more than 3 months after the original effective date and a maximum permitted duration of 4 months in total (accounting for renewals and extensions). This would apply to policies sold on or after the effective date.
- Explicitly states that payments from the employer to provide fixed indemnity plans are not excluded from the employee’s gross income if the amounts are paid without regard to the actual amount of medical expenses incurred, as well additional restrictions on how plans can be sold.
- Amend the current consumer notice requirements for both STLDI and Fixed Indemnity plans, revising both the content and formatting of the notice to promote better readability and comprehension. Notably, the Proposed Rule would add language to the notice that helps consumers identify how to enroll in comprehensive coverage, including links to reliable resources.
Read a summary of the Proposed Rule from Steptoe & Johnson here. If you have questions or comments regarding the Proposed Rule on short term health plans, please reach out to Katie King, VP of Health Policy & Strategy.
The Council Opposes New York’s Proposed Non-Compete Ban
The Council recently sent a letter from its leadership to New York Governor Kathy Hochul opposing S3100A, which was passed by the NY State Senate earlier this month and would broadly ban all non-compete agreements in the State going forward. There is currently no expected timeline for the Governor to review the Bill, and we continue to monitor for her response.
Read the letter. For more information on S3100A, visit the Yellow Alert issued by The Council on June 23.
Requesting Feedback on Revised Proposed Second Amendment to NYDFS Part 500 Cyber Regulations
On June 28, 2023, New York’s Department of Financial Services published a revised proposed Second Amendment to its Part 500 Cybersecurity Rules which imposes heightened cybersecurity obligations on large financial institutions. We intend to submit a second round of comments supporting the positive changes that were made and providing additional reasons why the suggested changes that were not made should be incorporated. Input can be sent to Joel Kopperud, SVP of Government Affairs.
For more information visit the Yellow Alert issued by The Council on June 28.
The Council pushes for delay in taxation of Roth catch-up contributions
The Council joined over 100 organizations to send a letter to Capitol Hill and Treasury in support of a two-year delay for the effective date of a catch-up provision included in SECURE 2.0, in recognition that many Americans have not have adequately saved for retirement. The provision would require that workers who earned over $145,000 in the preceding year from the current employer must make their catch-up contributions on a Roth basis. We are requesting this effective date be pushed from 2024 to January 2026.
The Council Supports Custom Health Option and Individual Care Expense Arrangement Act
The Council is a member of The Partnership for Employer-Sponsored Coverage (P4ESC), a nonpartisan advocacy alliance of employment-based organizations and trade associations representing businesses of all sizes and sectors. P4ESC recently submitted a letter to House and Senate leadership in support of H.R. 3799, the Custom Health Option and Individual Care Expense Arrangement Act. H.R. 3799, which incorporates several other bills and facilitates the provision of Health Reimbursement Arrangements (HRAs) to fund the purchase of individual coverage.
The NAIC Privacy Protections Working Group Released a 2nd draft of the Consumer Privacy Protection Model Law (#674)
As you recall, The Council submitted comments on the NAIC’s first consumer privacy draft on April 3. A revised memo outlining the key provisions of the model can be found here. The Council has been asked to review the draft and provide any comments by July 28, 2023. We ask that you provide any feedback by Friday, July 21 to inform our next round of comments. Key changes from the prior draft include:
- No longer prohibit cross-border sharing of consumers’ personal information.
- Addressed the industry’s concerns on deletion of personal information from legacy systems. The industry indicated that this process is costly and takes years to transition.
- Adding a provision to permit joint marketing agreements.
- Amending the definition of “third-party service provider to clarify that it does not include a licensee’s “affiliates.”
- Re-working and clarifying the whole subject of “marketing,” including allowing consumer to opt-out of marketing. Clarified that opt-in restrictions do not apply to the provision of insurance or other financial products and services.
- Removed the definition of “additional permitted activities.”
- Removed the requirement for an annual notice of privacy protection practices; instead, added requirement for a notice when there is a change in the licensee’s privacy protection practices. Added a drafting note as to what is not a change triggering a subsequent notice.
- Amended several of requirements for the content of the notices. Requires notice of crossborder sharing but not when in connection with reinsurance or sharing with an affiliate.
- Working with the interested parties on how the notice should be provided – issues with some parts of the US not having access to WiFi, computers, or cell service.
- Removed the provision on pre-text interviews—no one had ever heard of anyone using them.
- No longer prohibit cross-border sharing of consumers’ personal information.
- Addressed the industry’s concerns on deletion of personal information from legacy systems. The industry indicated that this process is costly and takes years to transition.
- Adding a provision to permit joint marketing agreements.
- Amending the definition of “third-party service provider to clarify that it does not include a licensee’s “affiliates.”
- Re-working and clarifying the whole subject of “marketing,” including allowing consumer to opt-out of marketing. Clarified that opt-in restrictions do not apply to the provision of insurance or other financial products and services.
- Removed the definition of “additional permitted activities.”
- Removed the requirement for an annual notice of privacy protection practices; instead, added requirement for a notice when there is a change in the licensee’s privacy protection practices. Added a drafting note as to what is not a change triggering a subsequent notice.
- Amended several of requirements for the content of the notices. Requires notice of crossborder sharing but not when in connection with reinsurance or sharing with an affiliate.
- Working with the interested parties on how the notice should be provided – issues with some parts of the US not having access to WiFi, computers, or cell service.
- Removed the provision on pre-text interviews—no one had ever heard of anyone using them.
The following changes also appear in this version of the Model but were posted with comments due July 10. The PPWG will review the comments received on these provisions before the Summer National Meeting.
- Removal of the options for a private right of action or not—instead, we are using the IDSA’s approach that states the Act does not create a PRA but does not take away any existing rights.
- Addressed AHIP’s concerns that the confidentiality provision was not strong enough (they wanted ORSA language). Worked with NAIC legal to strengthen the language without adopting the ORSA language.
- Provide a total HIPAA safe harbor if all personal information is treated as protected health information. Added a provision that if the licensee fails to qualify for the total safe harbor, the licensee is fully subject to the model law for all personal information that is not PHI.
- Removal of the options for a private right of action or not—instead, we are using the IDSA’s approach that states the Act does not create a PRA but does not take away any existing rights.
- Addressed AHIP’s concerns that the confidentiality provision was not strong enough (they wanted ORSA language). Worked with NAIC legal to strengthen the language without adopting the ORSA language.
- Provide a total HIPAA safe harbor if all personal information is treated as protected health information. Added a provision that if the licensee fails to qualify for the total safe harbor, the licensee is fully subject to the model law for all personal information that is not PHI.
