Understanding HIPAA compliance. (Legal).

Q: Must an association comply with the "privacy rule" of the Health Insurance Portability and Accountability Act of 1996?

A: The HIPAA privacy rule, which contains new federal standards governing the use and disclosure of most types of individually identifiable health information, applies only to health care providers, health care clearinghouses, and health plans known as "covered entities." It does not apply to employers as such.

However, the HIPAA definition of "health plan" is very broad and includes many types of employee-benefit plans typically sponsored by associations for their employees, including health, medical, dental, outpatient drugs, long-term care, flexible spending accounts, and most employee-assistance plans, although employer-sponsored plans with fewer than 50 participants that are entirely self-administered are exempt. Thus, an association-sponsored plan may well be a "covered entity" subject to the privacy rule. Nevertheless, an employer-sponsored group health plan that is fully insured (e.g., through an insurance contract or a health maintenance organization contract), and creates or receives only summary health information and enrollment or disenrollment information does not have to comply with most of the administrative and notice requirements of the privacy rule because the insurer/HMO must do so. It also should be noted that a health plan with less than $5 million in annual receipts has until April 14, 2004 (as opposed to an April 14, 2003 compliance date for all other covered entities) to comply.

Submitted by Michael B. Glomb, a partner of Feldesman Tucker Leifer Fidell & Bank, Washington, D.C. Glomb is a member of the ASAE Legal Section Council and a member of the Ask the Legal Section Committee. The "Legal" item is not intended as legal advice but rather as an educational overview.