Records Management Implications of the Affordable Care Act

Topics: Health Information Governance

Download PDF

The breadth of the Affordable Care Act requires all organizations to adopt more comprehensive recordkeeping practices that capture changes in retention requirements.


Signed into law on March 23, 2010, The Patient Protection and Affordable Care Act fundamentally altered the healthcare system in America, sending a tsunami of change through the health insurance industry and rippling to employers, health care providers and individuals across the nation. Also referred to as the Affordable Care Act (ACA) or Obamacare, it was amended by the Health Care and Education Reconciliation Act and survived a constitutional challenge. Thus far, the Department of Health and Human Services (DHHS) and the Centers for Medicare and Medicaid Services (CMS) have issued the majority of the regulations required by the ACA. The Internal Revenue Service has jurisdiction over the portions of the ACA that amend the Social Security Act and the Internal Revenue Code to create new taxes and credits. The ACA also contains amendments to the Employee Retirement Income Security Act of 1974, causing the Employee Benefits Security Administration of the Department of Labor (DOL) to issue new regulations. With major provisions of the law set to be implemented in 2014, organizations must meet the challenge of complying with a daunting array of changes in how they do business, along with complex regulatory compliance and recordkeeping requirements.

The ACA affects every employer in the United States, but has the greatest impact on large employers, defined as any business that has 51 or more full-time employees. A full-time employee is defined as any employee who works on average at least 30 hours per week.17 Employers are now required to provide to each employee, either by March 1, 2013 for existing employees or on the date of hire for new employees, a written notice containing information regarding the existence and nature of the Insurance Exchange, and tax and compensation information relevant to that employee.18 The DOL has issued model notices to assist employers with complying with this requirement. Employers will need to use their employee time and attendance records to demonstrate the full- or part-time status of their employees, as well as records of the coverage offered so that they can prove compliance with the employer mandate.19 In addition, from tax year 2012 on, employers must report the value of health-care coverage provided to employees on the annual W-2 forms.20

Grandfathered Health Plans and Recordkeeping Requirements

The ACA allows existing health plans to avoid complying with some of the coverage requirements and limitations provided they meet certain ongoing criteria. In order to qualify for these exemptions, a so-called “grandfathered health plan” must have had at least one individual enrolled in it on March 23, 2010. A grandfathered plan must comply with some, but not all, of the new coverage requirements under the Act. In their “Interim Final Rules for Group Health Plans and Health Insurance Coverage Relating to Status as a Grandfathered Health Plan Under the Patient Protection and Affordable Care Act,” the DHHS provided Appendix 1 (on page 7) to organize the provisions of the ACA that are and are not applicable to grandfathered plans.21

In order to maintain its status as a grandfathered plan, an eligible plan must include in the materials provided to the participants a statement that it believes it is a grandfathered health plan within the meaning of section 1251 of the ACA. It must also provide contact information for questions and complaints. The plan must also maintain records documenting the terms of the plan or health insurance coverage in connection with the coverage in effect on March 23, 2010, and any other documents necessary to verify, explain or clarify its status as a grandfathered health plan.22

If a plan entered into a new policy, certificate or contract of insurance after March 23, 2010 and was effective before November 15, 2010, then the plan is no longer eligible to be a grandfathered health plan. The regulations governing grandfathered plans also have certain anti-abuse measures that provide that a plan will lose its status as a grandfathered health plan if a merger, acquisition, or similar business restructuring occurs for the principal purpose of covering new individuals under a grandfathered health plan, or if employees are transferred into a grandfathered plan for a non-bona fide employment reason, such as for the purpose of changing the terms or cost of coverage.23

Recordkeeping Requirements for Health Insurers & Providers

Many new recordkeeping requirements have been issued in accordance with the Act. While the following list is not exhaustive, it includes the most noteworthy of the new recordkeeping requirements created under the ACA.

Medical Loss Ratio

One of the more significant reforms instituted by the ACA centers around the medical loss ratio, which is the percentage of consumers’ premium dollars that the insurance company spends on medical care versus the percentage that is pure profit or spent on administrative costs. The ACA requires health insurance companies to report data to substantiate the proportion of premium revenue spent on medical care and quality improvement. An insurance company that fails to spend 80-85% of premium dollars on medical care must pay a rebate to its customers.

Recent recordkeeping requirements require Medicare Advantage organizations to keep documents and records related to their medical loss ratio for 10 years from the date that calculations were reported to CMS.24 Part D (prescription drug plan) sponsors are also required to maintain documentation pertaining to their medical loss ratio for 10 years.25

Health Insurance Companies & Related Entities

  • Beginning August 1, 2013 group purchasing organizations26 and drug and medical device manufacturers must report to CMS all direct and indirect payments or other transfers of value, and ownership and investment interests held by a physician or an immediate family member of a physician during the preceding calendar year. These reports and the supporting records must be kept for five years from the date the payment or other transfer of value, or ownership or investment interest is published publicly.27 This rule originated in the Physician Payments Sunshine Act, which was incorporated into and passed as a part of the ACA.28
  • Health insurance issuers offering individual health insurance coverage are required to maintain for six year records of all claims and notices associated with the internal claims and appeals process.29
  • Third-party administrators30 may qualify for an adjustment in their Federally-facilitated Exchange user fee if they make payments for contraceptive services. For any adjustments made, the third-party administrator must keep detailed documentation of payments for contraceptive services for 10 years following the calendar year in which the adjustment was made.31
  • Qualified health plans32 must maintain records of coverage terminations in accordance with the requirements of the Exchange.33

Exchanges and the Health Insurance Marketplace

Physicians and practitioners who order diagnostic testing, including x-rays, laboratory and other tests must maintain documentation of medical necessity in the beneficiary’s medical record.

  • An Exchange or Small Business Health Options Program (SHOP)34 may elect to provide information regarding licensed agents and brokers on its website for the convenience of consumers seeking insurance through that Exchange and may elect to limit the information to data regarding licensed agents and brokers who have completed any required Exchange or SHOP registration and training process. If a consumer completes a qualified health plan (QHP) selection using an agent or broker’s Internet website, the site is required to maintain related audit trails and records in an electronic format for a minimum of 10 years.35
  • Exchanges must maintain records of all enrollments in QHPs made through the Exchange,36 and must also maintain records relating to terminations of coverage by QHP issuers in order to facilitate audit functions.37
  • SHOPs must:
    1. Provide each qualified employer with a bill on a monthly basis that identifies the employer contribution, the employee contribution, and the total amount that is due to the QHP issuer from the qualified employer;
    2. Collect from each employer the total amount due and make payments to QHP issuers in the SHOP for all enrollees;
    3. Maintain books, records, documents and other evidence of accounting procedures and practices of the premium aggregation program for each benefit year for at least 10 years;38 and
    4. Receive and maintain for at least 10 years records of enrollment in QHPs, including identification of qualified employers participating in the SHOP and qualified employees enrolled in QHPs.39

Medical Providers

Physicians and practitioners who order diagnostic testing, including x-rays, laboratory and other tests, must maintain documentation of medical necessity in the beneficiary’s medical record. An entity submitting a claim must maintain the documentation that it receives from the ordering physician and proof of accuracy.40

Actions to Take for Corporate Compliance

Whether you need to comply with the ACA because your organization falls under the definition of a large employer or because your organization is an issuer of health insurance plans or performs other covered functions, the following are implementation suggestions that you should consider to enable compliance:

  • Analyze your organization’s Records Retention Schedule to identify records governed by new recordkeeping requirements and ensure that the retention period is sufficient for compliance. In some cases, the retention period may need to be increased.
  • Determine whether new classes of records need to be kept to satisfy new recordkeeping requirements.
  • Reach out to the business unit users impacted by the regulations to apprise them of the changes and their new responsibilities.
  • Update any applications, systems, processes or repositories that use retention rules to manage the regulated records.
  • Foster collaboration between Records Management and IT to determine how to comply with storage requirements.


Iron Mountain is regularly capturing recordkeeping requirements issued under the Affordable Care Act, and incorporating them into our records management programs. Iron Mountain Consulting is prepared to help our clients ensure that their records management programs are in full compliance with the latest requirements. Our continuously updated legal research repository will link the new requirements to your Records Retention Schedule, and associated records.

For more information about how Iron Mountain can help you ensure that your organization is ACA-compliant, contact Iron Mountain at

Read more…