Final HIPAA/HITECH Rules: Compliance Actions for Employee Benefit Plans

The Department of Health and Human Services recently released final regulations modifying the HIPAA Privacy, Security Breach Notification and Enforcement Rules (the “Omnibus Rule”). These regulations have far-reaching effects on covered entities, business associates and subcontractors, including employer-sponsored group health plans. This article focuses on the impact of the Omnibus Rule on group health plans, including medical plans, health care flexible spending accounts, wellness programs and employee assistance programs where individually identifiable health information may be generated or received. For a broader discussion of the Omnibus Rule, click here.

When health information that identifies the individual to whom it relates is created or received by a HIPAA covered entity, such as a group health plan (or by a plan sponsor or business associate of the covered entity), this data becomes protected health information (PHI) and is subject to HIPAA’s privacy rule. HIPAA’s security requirements apply when PHI is transmitted or maintained in electronic media, known as “electronic PHI.”

The HIPAA privacy rule allows employers who sponsor fully-insured group health plans to rely on the insurance company to comply with most of the HIPAA privacy requirements if the employer has access only to limited, summary health information. However, fiduciary obligations and practical constraints may make it difficult even for the sponsor of a fully-insured group health plan to insulate itself from the receipt of PHI. If the plan sponsor is involved in certain administrative functions, such assisting employees with filing medical claims or appeals or reimbursing health care flexible spending account claims, the plan sponsor will likely receive PHI and will be subject to HIPAA’s privacy rule. Furthermore, both self-insured and fully insured plan sponsors are subject to HIPAA’s breach notification and security provisions.

Plan sponsors should note that the Omnibus Rule expands the definition of business associate and those parties subject to HIPAA’s Privacy and Security Rules and applies HIPAA’s civil and criminal penalties directly to business associates. Under the Omnibus Rule, business associates, including subcontractors of business associates, are directly liable for compliance with the Privacy and Security Rules if they create, receive, maintain or transmit PHI on behalf of the company or the plan. Such business associates for group health plans may include:

Employee benefit plans may be required to update their notice of privacy practices (NPPs), policies, procedures and training programs to address these rule modifications. Covered entities, including employee group health plans, must have up-to-date business associate agreements in place with all vendors who meet the expanded definition of a business associate. HIPAA already required most covered entities to maintain an NPP which explained the permissible uses and disclosures of PHI. The Omnibus Rule requires that additional information be included in the NPP, including revised information regarding the plan’s use of genetic information. The Omnibus Rule requires genetic information to be treated as PHI and prohibits a plan from using or disclosing genetic information for underwriting purposes. 

The Omnibus Rule provides individuals with the right to restrict certain disclosures of PHI to health plans. If requested by the individual, a covered entity, such as a medical provider, must restrict disclosures of PHI to the health plan if the PHI pertains solely to an item or service for which the individual (or a party other than the health plan) has paid the provider for in full.

The Omnibus Rule confirms that individuals have a right to request copies of their PHI in any form they choose, provided the PHI is in a readily producible format. Requests for PHI must be addressed within 30 days, with a one-time 30 day extension permitted if the individual is given notice and the reasons for the delay.

To ensure timely compliance with the Omnibus Rule, employee benefit plan sponsors and their attorneys should:

1. Identify all plans that may be subject to the Omnibus Rule, including major medical plans, wellness programs, healthcare FSAs, employee assistance programs and other programs where PHI may be generated or received;

2. Review the scope of services with vendors to determine whether business associate and subcontractor relationships exist and whether business associate agreements should be put in place;

3. Review and revise existing business associate agreements to comply with the new requirements of the Omnibus Rule;

4. Ensure that business associates execute business associate agreements with their subcontractors;

5. Review HIPAA language in health, wrap and cafeteria plan documents;

6. Revise each plan’s NPP and distribute to participants in accordance with the new requirements of the Omnibus Rule;

7. Train employees, independent contractors and contract workers to comply with the new rules;

8. Prepare the appropriate parties to comply with requests from individuals for copies of their PHI;

9. Adopt or update written breach notification procedures; and

10. Review each plan and the plan sponsor’s use of genetic information to ensure compliance with GINA and the Omnibus Rule.

The compliance deadline for these rules is September 23, 2013. Certain existing business associate agreements won’t need to be updated until September 22, 2014 provided they are not modified or renewed prior to that date. In the meantime, health plan sponsors should review their HIPAA compliance and take the steps necessary to update their policies, procedures and documents.