American Journal of Law & Medicine

Direct contracts, data sharing and employee risk selection: new stakes for patient privacy in tomorrow's health insurance markets.

The central storage and easy accessibility of computerized data vastly increase the potential for abuse of that information, and I am not prepared to say that future developments will not demonstrate the necessity of some curb on such technology.(1)

--Justice William Brennan


In the decades since the United States Supreme Court's consideration of informational privacy in Whalen v. Roe, a couple of worthy candidates to fulfill Justice Brennan's premonition of "future developments" have emerged. One is the nature of information technology itself. Today, sensitive health care data are generated, stored, transferred, and deployed toward countless uses with astonishing facility. An inexorable shift toward computerized medical records and fully automated storage and transfer of patient information is well underway.(2)

Consider the Whalen Court's concern in 1977: the threat posed to patient privacy by a centralized reporting system that collected prescription forms for controlled substances.(3) The forms were filled out in triplicate by the treating physician and forwarded to the New York State Department of Health where they were "sorted, coded, and logged and then ... recorded on magnetic tapes for processing by a computer."(4) In 1998, New York State enacted a law converting the state-issued triplicate prescription form into a new single form that pharmacies will forward to the Department of Health for all future monitoring of Schedule II controlled substances and benzodiazepines.(5) The entire process is electronic and instantaneous.(6)

The other ground shift since Whalen is linked to metamorphoses in the organization of the health care system. Led by employer intolerance with double-digit premium hikes in the late 1980s,(7) managed care spread rapidly beyond its early strongholds in California and pockets of the Midwest.(8) Managed care organizations (MCOs), with their ability to bring market incentives to bear directly on the doctor-patient encounter, were positioned to provide care at a lower cost and thus could respond to employer calls for cost containment with lower premium bids.(9) Competition among various delivery configurations has spawned a variety of new organizational forms and caused considerable market flux.(10) More than 73% of all privately insured workers and their families, approximately 40% of Medicaid beneficiaries, and approximately 15% of the Medicare population are now in some form of managed care.(11)

New financing and delivery arrangements rely heavily on data from the patient encounter to calculate expected costs, track expenditures, reimburse providers, monitor health care utilization and improve quality of care.(12) For physicians, multilateral responsibilities have replaced an ancient tradition of bilateral commitment. Exchange and use of health care data threaten patient interests in privacy and confidentiality as never before.(13)

This Article describes a particular type of organizational arrangement and examines a set of concerns this arrangement raises regarding use of health care data in the workplace. Direct contracts between employer-purchasers of health insurance and provider-sponsored organizations (PSOs) differ from more conventional managed care models by not mediating relations between purchaser and provider through a health plan or insurer. Part II describes the history and use of such contracts, highlighting several recent developments that focus greater attention on them as potentially attractive delivery options. Part III argues that the tighter nexus between purchasers and providers in direct contracting arrangements accentuates troubling incentives to transfer and use sensitive health care data in ways that may conflict with the best interests of employees. Part IV analyzes legal protections, both current and proposed, for dealing with misuse of health information by employers. After identifying a number of shortcomings in these laws, Part V briefly outlines one policy option, the "health information trustee," for safeguarding the privacy interests of patients receiving their health care through direct contracts.



The term direct contracting refers to an arrangement for the provision of health care services conducted between a PSO(14) and an entity not licensed to insure, typically a self-insured employer or business purchasing consortium securing services for employee groups.(15) By contrast, the dominant organizational model in managed care markets involves employers purchasing insured or self-insured products from health plans,(16) which then contract either directly with individual physicians for services or indirectly via physician groups.(17) Thus, the absence of an insurance intermediary and the resultant proximity in the contractual relations between purchaser and provider define the difference between direct contracts and standard managed care purchasing arrangements.(18) Administrative responsibilities, including costing, reimbursement, claims processing, utilization review, case management and regulatory compliance, are divided between providers and employers (or their designees).(19)

Direct contracts differ across several key dimensions, one being the amount of risk assumed by providers.(20) PSOs may assume no substantive risk and simply provide employers with discounted charges on a fee-for-service (FFS) basis in exchange for patient volume.(21) Partial assumption of risk occurs when providers discount premiums by offering all-inclusive fixed rates for hospital days (per diem discounts) or admissions (per case discounts).(22) PSOs may also take on full risk in capitation arrangements where a predetermined set of services is provided as needed for a fixed fee, typically calculated on a per-enrollee per-month basis.(23) A 1991 survey of ten hospitals involved in direct contracting found that three were paid on a discounted charge basis while the others used some form of risk-sharing arrangement.(24)

Direct contracts also differ according to the menu of services provided. Some arrangements involve provision of a specialty-limited program of care, such as cardiac or psychiatric services; others cover the full range of medical and surgical tertiary care services.(25) Alternatively, services may be circumscribed according to the locus of care: inpatient hospital, outpatient hospital or clinic, or physician services only.(26) Thus, variation across both reimbursement arrangements and service packages yields a range of possibilities for a direct contract's profile.(27)


Direct contracting arrangements are an outgrowth of highly developed purchasers and providers. Although these arrangements date back to the early 1970s, historically there was neither capacity nor enthusiasm for pursuing them, other than through isolated disease management programs and limited on-site employee care programs.(28) As health care premiums skyrocketed in the late 1980s and early 1990s, and new financing and delivery models began to jostle for attention, interest in direct contracts intensified. A series of articles in the leading trade journals at this time forecasted direct contractors as leaders in an industry-wide revolution that would render health maintenance organizations (HMOs) and other insurance intermediaries largely obsolete.(29) Clearly, direct contracts have not assumed that stature; the predominant financing and delivery model in today's managed care markets continues to be built around health plan intermediaries.

Why have direct contracts not proliferated as many commentators predicted they would a decade ago? A number of obstacles have attenuated their growth. First, the contracting parties have either lacked the capability or the inclination to make direct contracting arrangements work.(30) Most PSOs are ill equipped to assume responsibility both for elevated risk and the bulk of the administrative responsibilities currently taken on by health plans.(31) In particular, PSOs lack the management expertise and information system infrastructure necessary to price, accept and manage contracts.(32) Providers also may fear market retaliation from health plans on which they would rely for the balance of their patient stream.(33) However, health plan responsibilities are not simply devolved in toto to PSOs in direct contracting arrangements. Employers must also assume a heightened role in oversight and benefits administration, and few, at least until recently, have exhibited an appetite for such duties.

Second, insurance regulation generally prevents PSOs from taking on insurance risk in direct contracts without first obtaining an insurance license(34) Most states have determined that acceptance of capitated payments from employers in direct contracting arrangements satisfies the McCarran-Ferguson Act criteria for the business of insurance.(35) The onerous capital reserve requirements insurance regulation introduces are typically prohibitive for a prospective PSO.(36)

Third, prior to 1996, antitrust laws might have limited the opportunities for PSOs to evolve through successive stages of consolidation into organizational forms mature enough to enter direct contracting arrangements. At the most basic level, physician agreements about the fees they will charge a health plan or purchaser were regarded as price fixing, and illegal per se.(37) Partial integration, involving pooling of some economic resources and some shared financial risk, but stopping short of full practice mergers and capitated contracts, occupied a gray zone. This partial integration was subject to "rule of reason" review wherein the regulator investigates whether the arrangement had or is likely to have a material adverse effect on market competition.(38) Full organizational and economic integration has fared best under antitrust scrutiny because these features are regarded as consistent with market efficiencies.(39) Because a key indicator of economic integration is shared financial risk, Alison Overbay and Mark Hall have noted that "the antitrust laws make it difficult for physician groups to form that do not assume insurance risk."(40)

Guidelines issued in 1996 alleviated some of the antitrust concerns surrounding formation of noncapitated PSOs.(41) Nonetheless, at least through 1996, antitrust regulation may well have inhibited interest in direct contracts by retarding the development of PSOs sophisticated enough to pursue them. When these incentives are coupled with those emanating from a desire to avoid the demands of insurance regulation (i.e. by maintaining loose affiliation), prospective PSOs are confronted with a set of legal signals that Overbay and Hall have described as "inconsistent, or perhaps flatly contradictory...."(42)

Finally, and perhaps most important, enthusiasm for direct contracting has been dampened by the success of the health plan as the nucleus of a delivery system able to hold premium increases in check. From a cost-containment perspective, the intermediary-centered model largely met employers' expectations.(43) However, concerns are mounting: (1) that purchasers' expectations have been rather myopic;(44) and (2) that plans' success represents a hiatus rather than a permanent brake on health care cost inflation.(45) Unrest grows among an increasingly sophisticated coterie of large group purchasers about the ability of HMOs to return value, as measured by member satisfaction, quality improvement and commitment to long-term cost-reduction strategies.(46)


What limited data are available on the prevalence of direct contacts reveal a surprising market penetration. A 1992 survey of employers in Iowa, Kansas, Missouri, Nebraska and Oklahoma found that 29 percent were either involved or interested in pursuing direct contracts.(47) In 1996, approximately 30 percent of physicians in practices with 25 or more physicians were engaged in at least some form of direct contracting activity with employers.(48) Many employers and providers are presently engaged in direct contracts, and interest in these arrangements continues to grow.(49)

The leading example of direct contracting in the United States today is a program operated by Minnesota's Buyers Health Care Action Group (BHCAG).(50) BHCAG grew out of a coalition of six large employers that came together in the Minneapolis-St. Paul area in 1988.(51) Its initial aim was to monitor and lobby for health care legislation.(52) After becoming increasingly frustrated with the oligopolistic behavior displayed by the small number of HMOs in the local health insurance market, BHCAG embarked on a consolidated purchasing initiative in 1992 and established the "Choice Plus" plan, which attracted 125,000 enrollees in its first four years.(53) This benefits plan organized services through a reconfigured consortia of local providers, hospitals and HMOs.(54)

The reforms aimed to stimulate competition among health care providers by arming consumers with information on cost, quality and customer-service performance with which to select among health insurance options.(55) Although some impressive cost-savings were quickly realized,(56) "the changes induced by the efforts begun in 1992 were not seen by BHCAG employers as sufficient to create appropriate market-based incentives for providers of care to improve their quality, service level, and costs, in accordance with BHCAG's stated objectives."(57)

BHCAG launched a second reorganization, the "consumer choice model," in 1997. Direct contracts are its centerpiece.(58) Through Choice Plus, consumers may now choose among 15 competing care systems(59) that offer the same benefits package at one of three different premium levels. Primary care providers may participate in only one care system.(60) BHCAG contracts directly with the care systems for provision of care.(61)

To establish premium levels, care systems submit estimated per-member per-month rates (claims targets) for providing the standardized benefits package.(62) BHCAG works with providers to make diagnosis-related risk adjustments to each care system's claims target so that a care system will not experience competitive benefits or disadvantages from cost variations attributable to adverse selection--differences in the burden (and cost) of illness among the populations that select into each care system.(63) Differences in care system target rates are reflected directly in premiums paid by plan enrollees. Premiums are paid from the funds of each employer directly to the provider in the care system.(64)

Each quarter, care systems' respective fee schedules are adjusted up or down to reflect performance against their risk-adjusted claim target.(65) BHCAG members may not retrospectively recover money from care systems that exceed their targets.(66) Furthermore, unlike capitated systems, reimbursement monies are not collected and pooled prior to delivery of care. Instead, they are paid when claims are submitted. Thus, BHCAG's reimbursement model represents a modified retrospective payment model. The modifications are designed to capture the efficiency incentives of a prospective payment model without stimulating incentives for care systems to rid their enrollee populations of sick, expensive patients.(67)

BHCAG itself does not actually perform the risk adjustment and utilization analysis work, nor do its member employers.(68) Through 1998, the coalition employed HealthPartners, a parent company to several local MCOs, with Aetna as its subcontractor, to deliver a number of administrative services including enrollment, claims payment, member services, contracting and case management services for catastrophic, out-of-area and out-of-plan network events.(69) BHCAG recently announced that a new consortium, which includes general consulting, actuarial and information management firms, will replace HealthPartners in 2000.(70)

BHCAG has grown to comprise twenty-eight self-insured firms in the Twin Cities area. Members include Minnesota Mining & Manufacturing Co. (3M), Dayton Hudson Corp., American Express Financial Advisors, Inc., Honeywell, Inc. and other major employers representing approximately 400,000 employees, retirees, and dependents in the region.(71) In 1998, BHCAG contracted directly for $165 million in services for approximately 130,000 enrolled participants.(72) While this represents only a small portion of the market for health care in the Twin Cities area.(73) Choice Plus claims some notable breakthroughs. Enrollee selection patterns in 1998 appear to have tracked care systems with lower premiums and higher grades in publicized patient satisfaction surveys.(74) In addition, BHCAG's anticipated premium increases in 1999 are approximately five percent, substantially less than those expected by employers elsewhere.(75)

A number of other notable experiments with direct contracting have been pursued in recent years.(76) In Florida, Orange County Public Schools, faced with 21 percent rises in health care from MCOs in the early 1990s, went directly to Orlando Regional Medical Center to arrange for health care services for 14,000 employees.(77) Other Orlando employers have followed suit.(78) In Baltimore, Johns Hopkins Health System reached out to employers with its Employee Health Plans package.(79) In 1996, Motorola, Inc. launched its own health plan based on direct contracts with health providers in Schaumburg, Illinois.(80) Other direct contracting efforts have begun in the Dallas-Fort Worth area.(81) Finally, two employers in the BHCAG coalition have separately pursued their own direct contracting initiatives: Honeywell, Inc., with Park-Nicollet Medical Center, and 3M with a prominent physician-hospital organization, HealthEast.(82)


BHCAG's experience hints at a number of forces currently simmering in managed care markets, which may coalesce and fuel growth of direct contracting. Patients, providers, and purchasers may each look toward this organizational alternative to remedy their dissatisfaction with health plan performance.

Consumers fortunate enough to have coverage options complain about the bewildering array of health plan choices.(83) Many plans are built around a capitated gatekeeper model with distressing restrictions on choice of physician, access to specialists and availability of certain procedures.(84) Physicians, still reeling from the loss of professional autonomy ushered in by 1990s-style managed care, are eager to seize back control of service delivery.(85) They resent relying on MCOs for patient volume, and bristle against "labyrinthine" protocols for approval of care and payers' "unsympathetic demands" to assume more risk for lower fees.(86) Although the formation of PSOs has strengthened the bargaining clout of many physicians, even large networks may find themselves squeezed as health plans attempt to contain premium increases while maintaining profits.(87)

Employer-purchasers claim disenchantment on a number of fronts.(88) Some perceive plans have their "eyes on Wall Street" rather than on dedication to development of long-term efficiency and quality improvement strategies.(89) Meanwhile, employers are becoming nervous about antipathy between providers and health plans. Large, multispecialty PSOs have begun to revolt against the demands of plans. For example, a recent struggle between Blue Cross of California and Sutter Health, a PSO serving more than three million in Northern California, temporarily threatened continuity of care for many employees in the area.(90) As such struggles intensify, employers worry that provider-plan fractiousness could result in higher costs, interruptions of care and mounting complaints among employees when physician groups exit their benefit plan.(91)

However, the allure of direct contracting does not stem solely from its potential to allay dissatisfaction with prevailing organizational models. Simple cost imperatives persist. …

Log in to your account to read this article – and millions more.