Vermont Regulatory Action: A Reminder that Insurers Must Maintain Oversight of their TPA and PBM Business Partners
The Vermont Department of Financial Regulation (the “Department”) recently took significant enforcement action against an insurer after determining that the insurer had violated various provisions of Vermont’s insurance laws, which included the insurer’s failure to adequately supervise its third party administrator (“TPA”) and pharmacy benefits manager (“PBM”) business partners. The regulatory action resulted in payments by the insurer exceeding $1.8 milllion, mandatory changes to the insurer’s control systems and required reports to the Department on an ongoing basis.
The regulatory action arose out of a market conduct examination by the Department targeting certain of the insurer’s health plans that were sold in Vermont over the course of several years. The examination revealed multiple violations of Vermont’s insurance laws, including use of potentially misleading marketing materials and unapproved policy forms, failure to provide certain coverages mandated by state and federal law, failure to maintain adequate complaint procedures, failure to file annual complaint reports and improper denial of claims. The Department noted that the insurer often used TPAs and PBMs to carry out the activities (e.g., marketing, sales, policy administration, claims handling and claims adjudication) that led to many of the alleged violations.
In the course of its examination, the Department also determined that the insurer did not maintain sufficient records to allow the Department to reconstruct claim activities or to demonstrate that the insurer exercised adequate oversight of its TPA and PBM business partners. Additionally, the Department determined that the insurer failed to confirm that one of its PBM business partners was properly registered in Vermont before doing business with that PBM. As a result of the various alleged violations of law which were discovered during the examination, the Department found that the insurer did not adequately supervise the actions of its TPA and PBM business partners in violation of 18 V.S.A. § 9472 and Department Regulation H-2009-03. The Department also concluded that the insurer was responsible for the acts of its contracted TPAs and PBMs under common law principles of agency as defined by Vermont case law.
Following the examination, the Department entered into a Stipulation and Consent Order (the “Order”) with the insurer. The Order required the insurer to make payments in an amount that exceeded $1.8 million. That figure includes a $950,000 administrative penalty, a $150,000 contribution to the Vermont Financial Services Education and Victim Restitution Fund, a $225,000 contribution to Vermont Legal Aid and $481,000 in reimbursements to insureds. The Department also required the insurer to develop a “Corrective Action Plan” that included various mandatory elements. Some of the noteworthy elements in the Corrective Action Plan required the insurer to (1) create a robust internal compliance program; (2) enhance its capabilities to supervise its business partners, including strengthening contracts with those entities; (3) perform regular audits of its business partners and subsequently report any issues identified in the audits to the Department along with a plan for remedying those issues; (4) provide regular status updates to the Department regarding the resolution of issues identified during audits and compliance with the Corrective Action Plan more generally; and (5) compensate the Department for any expenses it incurs while reviewing the insurer’s compliance with the Corrective Action Plan. To satisfy the requirements of the Corrective Action Plan, the insurer created two new business units – one tasked with improving internal control systems and the other tasked with improving business partner compliance – and staffed each with several full-time compliance professionals.
Like the regulatory actions discussed, this action by the Vermont Department is a reminder of the significant regulatory consequences that can result when an insurer fails to properly supervise its TPA and PBM business partners.