HIPAA does not apply to your company. It applies to your health plan — and that is where employers get caught.
The rule everyone quotes is not the rule that binds you. Your business is not a covered entity. Your group health plan is, and the moment your HR team handles information that belongs to the plan, a specific set of obligations attaches to you as its sponsor. Penalties run from $145 to $2,190,294 a year, and the criminal provisions reach individuals, not just organizations.
The employer is not the covered entity. The plan is.
This distinction decides almost every HIPAA question an employer asks, and almost nobody draws it correctly.
Your Employment Records Are Not PHI
A doctor’s note handed to a manager, an FMLA certification, a workers’ compensation file: these sit in your employment records, outside HIPAA. Other laws govern them, and the ADA is usually the one that matters. What makes a record HIPAA’s concern is the capacity in which you hold it. The same diagnosis on a claims report the carrier sends you is plan information; on a note an employee hands you for a leave request, it is an employment record.
The Plan Is a Covered Entity
Your group health plan is covered. So is the carrier, and so is any vendor handling claims. The plan’s information does not become yours just because you pay for the plan. In practice, a claims report or a list of large claimants from the carrier is plan information, and it brings HIPAA obligations with it the moment it lands in an HR inbox. The question to ask is who at your company receives anything from the carrier or a claims vendor, and why.
Where the Line Blurs
It blurs the moment your people touch plan data, a self-funded plan, an HRA or health FSA you administer, a wellness program tied to the plan, or an HR manager who takes a claim problem and calls the carrier.
Two Things You Can Receive Freely
Summary health information, when you are getting premium bids or deciding whether to change the plan, and whether an individual is enrolled. Those two move to a plan sponsor without the full apparatus. Summary health information is claims history with individual identifiers stripped out, the kind of experience report underwriters use when quoting. Ask for it in that form. Anything with names, member IDs or other identifiers attached falls outside the exception.
Fully Insured and Hands-Off
A fully insured plan whose sponsor receives nothing beyond those two categories carries a much lighter load. Most employers assume they are here. Fewer are than think. Staying here is a choice you make repeatedly: every report you request from the carrier either stays inside those two categories or moves you into the full plan-sponsor rules.
Business Associates
Anyone handling PHI on the plan’s behalf (third-party administrator, broker, benefits platform, COBRA vendor) needs a business associate agreement, and they carry their own liability under the rules. The agreement sets what the vendor may do with the information, what safeguards it keeps and how it reports a breach, so an unsigned one leaves all three open. Inventory every vendor that receives an eligibility or claims file, not just the obvious ones.
Four things have to be true before plan information reaches you.
These come from the plan-sponsor rules, and they are the part employers most often have never done.
1. The Plan Documents Say So
The plan document has to be amended to describe what the sponsor may do with the information, with protections that match the rule. A benefits guide is not a plan document, and a certificate of coverage is not either. A carrier certificate describes coverage, not the sponsor’s access, so the amendment usually lives in a wrap document that sits over the insurance contracts. We help you put that document in place and bring in ERISA counsel where the language needs it.
2. You Certify It in Writing
Before the plan discloses anything, the sponsor certifies that the documents have been amended and that it agrees to the restrictions. Until that certification exists, the disclosure is not permitted. The certification is a short signed statement from the sponsor to the plan. Date it and file it with the plan documents, because if an audit or a breach ever puts your access in question, it is the first thing anyone will ask to see.
3. Named People, Limited Access
The documents must name the employees or classes of employees who may see plan information, and limit them to plan-administration work. This is the separation requirement (the firewall) and it has to be written down, not assumed. Name roles rather than individuals where you can, so the list survives a job change. Payroll staff and line managers generally sit outside the firewall unless they do plan-administration work.
4. Never for Employment Decisions
Plan information cannot be used for employment-related actions or for any other benefit. Not for an attendance question, not for a promotion, not for a layoff list. There also has to be a mechanism for resolving noncompliance when it happens.
What it costs, at 2026 amounts.
Tier 1 — You Did Not Know
$145 to $73,011 per violation, and you could not reasonably have known. The floor is low; the ceiling is not. It still counts per violation, so one gap repeated across many records can move the total quickly. Document what you checked.
Tier 2 — Reasonable Cause
$1,461 to $73,011 per violation. You knew, or should have, but it was not willful neglect. Reasonable cause covers a failure you should have caught that was not a conscious disregard of the rule. A known gap left open is where it starts to look like willful neglect, so correct it promptly and keep a dated record of the fix.
Tier 3 — Willful Neglect, Fixed Fast
$14,602 to $73,011 per violation, where the failure was willful neglect and you corrected it within 30 days. The 30 days run from when you knew, or should have known, about the failure. A dated record of the correction is what separates this tier from the next one.
Tier 4 — Willful Neglect, Not Fixed
$73,011 to $2,190,294 per violation. The floor here is the ceiling of every other tier. This tier applies when willful neglect is not corrected within 30 days of when you knew, or should have known, about it, so correcting quickly is what keeps a finding out of it.
The Annual Cap
$2,190,294 for all violations of an identical provision in a calendar year. Effective for penalties assessed on or after 28 January 2026 [the figures are inflation-adjusted annually]. Each separate provision carries its own cap, so one incident that breaks several rules at once can reach the cap more than once.
The Criminal Side Reaches People
Knowingly obtaining or disclosing health information: up to $50,000 and a year. Under false pretenses: $100,000 and five years. To sell it or for personal gain or malicious harm: $250,000 and ten years. The Department of Justice prosecutes these separately from the civil fines above, so one incident can carry both.
Sixty days, and it starts at discovery.
Not at confirmation, not when the investigation finishes. Discovery is when the clock starts, and it is the detail that turns a manageable incident into a late one.
Individuals
Notice to each affected person without unreasonable delay and no later than 60 days after discovery. The notice has to say what happened, what information was involved, what the person should do to protect themselves, what the plan is doing about it and how to reach the plan with questions. First-class mail to the last known address is the default method, or email where the person has agreed to it.
500 or More in One State
Prominent media notice in that state or jurisdiction, on the same 60-day clock. The count is per state, so a breach spread thinly across several states can require the federal report without triggering media notice in any one of them. Media notice is in addition to the individual letters, not a substitute for them.
Health and Human Services
For a breach of 500 or more, notify within 60 days. Under 500, log it and report within 60 days after the calendar year ends. Reports go through the HHS online breach portal, and larger breaches are posted publicly. Keep the log for smaller incidents current through the year, so the annual report is a filing exercise rather than a reconstruction.
Your Vendors
A business associate has 60 days from discovery to tell the plan. Your clock does not restart because theirs ran first. Your business associate agreement can require a shorter reporting window than the rule allows, which gives the plan time to investigate and still notify inside its own deadline.
Who Carries the Obligation
The covered entity remains responsible for notifying individuals. You can delegate the work to a vendor; you cannot delegate the responsibility. Put the delegation in writing, including who drafts the letters and who pays for mailing and any credit monitoring. Keep a copy of every notice sent, since the plan has to be able to show it met the deadline.
What Is Coming
A Security Rule overhaul was proposed in January 2025 and drew more than 4,000 comments. It is not final, the current target for final action is 2027, which makes now the cheap time to get the basics in place.
Most of this is paperwork you only have to do once.
The obligations are unglamorous and finite. The exposure comes from never having done them.
Find Out What You Actually Touch
Self-funded or fully insured, what your HR team handles, which vendors see plan data, whether your wellness program pulls information back to you. That settles which of the rules above apply before anyone drafts anything. We do this through a short conversation with HR and a look at the reports and files that actually reach your team from the carrier and each vendor. The answer sometimes differs from what the plan’s funding type would suggest.
Documents, Certification, Access List
Plan documents amended, the sponsor certification signed, and the named people written down with their access limited to plan administration. This is the part that makes the rest defensible. We help you put the amendment, the certification and the access list in place together, so all three reference the same plan and the same people. A mismatch between them is an easy finding for an auditor.
Business Associate Agreements
Every vendor touching plan information gets one, and we check the ones you already have, because inherited agreements are often with companies you no longer use. We also confirm each agreement matches what the vendor does today, since a vendor that has added claims support or a new platform may have outgrown the one on file.
A Response Plan Before You Need One
Who is called, what gets documented, and where the 60-day clock starts. When a question runs past what a licensed insurance broker should answer alone, CPAs and ERISA attorneys are available through us. We help you write it as a short checklist: the first calls, the facts to capture and the point at which counsel takes over.
What employers ask once they realize the plan is the covered entity.
Each of these comes up in the first conversation, usually in this order.
Does HIPAA apply to us as an employer?
Not directly. Your group health plan is the covered entity, and obligations reach you as the plan sponsor when you receive the plan’s information. Records you hold as an employer are not covered by HIPAA at all. The practical question is what your HR team actually receives from the plan and its vendors, because that decides which sponsor obligations apply to you.
An employee gave us a doctor’s note. Is that a HIPAA problem?
No. That is an employment record. Handle it carefully for other reasons — the ADA, the FMLA, and plain good practice — but HIPAA is not the law in play. Keep it in a confidential medical file separate from the personnel file, and share it only with the people who need it to manage the leave or the accommodation.
We are fully insured. Are we exempt?
Lighter, not exempt. If the sponsor receives only summary health information and enrollment status, the load is small. Take claims detail, run an HRA or FSA, or handle appeals, and the full plan-sponsor rules apply. If you are close to the line, the fix is not always more paperwork. Sometimes it is routing appeals and claim questions back to the carrier, so the plan’s information never reaches your team.
Do we need a business associate agreement with our broker?
If the broker handles protected health information on the plan’s behalf, yes. The test is what the vendor touches, not what the vendor is called. A broker that only quotes and places coverage using summary information may not need one. A broker that steps into individual claim problems on employees’ behalf is handling PHI and should have one on file.
What does a violation actually cost?
It depends entirely on culpability. No knowledge starts at $145 per violation; willful neglect left uncorrected starts at $73,011 and runs to $2,190,294, which is also the annual cap for repeated violations of the same provision. Penalties are counted per violation, and a continuing failure can be counted for each day or each person it affects, which is how a small gap reaches the cap.
Can an individual go to jail for this?
The criminal provisions apply to people, not only organizations: up to a year for knowingly obtaining or disclosing health information, five years under false pretenses, and ten years where the intent is to sell it or profit from it. The realistic exposure is an employee who looks up a coworker’s claims out of curiosity or passes them along. Access limits and training are what keep that from happening on your plan.
A laptop went missing. How long do we have?
Sixty days from discovery to notify the individuals, and the same sixty for Health and Human Services if 500 or more people are affected. Under 500, you log it and report after the year ends. Start the log on the day the loss is reported, and establish whether the device was encrypted, because properly encrypted data generally does not count as a reportable breach.
Our vendor had the breach, not us.
The plan still notifies. The vendor owes you notice within 60 days of discovery, and you can have them do the mailing, but the obligation stays with the covered entity. Review the vendor’s draft letter and the list of affected people before anything is mailed, since an error in either becomes the plan’s problem.
Can HR see claims to help an employee?
Only if the plan documents name those people, their access is limited to plan administration, and the sponsor has certified the amendment. Helping an employee is a good reason; it is not a substitute for the paperwork. The fix is usually modest: name the benefits lead in the documents, sign the certification and keep that person’s access to claims work only.
Is anything changing?
A significant Security Rule update was proposed in January 2025 and is still not final, with action now expected around 2027. Nothing about the current obligations is on hold in the meantime. The proposal emphasizes written security policies, an inventory of systems that hold health data, encryption and multi-factor authentication, so plans that already keep data in a controlled system will have less to change.
General information about HIPAA as it applies to employer-sponsored health plans, not legal advice. Plan-specific questions belong with ERISA counsel, and we will bring them in.
The rules in one place.
HIPAA And Privacy For Employer Health Plans
Plan sponsor basics, vendor risk and breach readiness, in one place.
Business Associate Agreements
What a vendor agreement must cover.
HIPAA Breach Notification
Steps and deadlines when plan information is exposed.
HIPAA For The Plan Sponsor
Employer records versus plan information.
HIPAA Security Rule
Safeguards for electronic plan information.
Minimum Necessary Standard
Who at the company sees plan information.
HIPAA Authorizations
When the plan needs written permission.
HIPAA Individual Rights
What your plan owes employees who ask.
HIPAA Notice Of Privacy Practices
Who must give one and how often.
HIPAA Training, Sanctions And Records
The administrative duties employers skip.
Where the Rules Come From.
The laws and rules named on this page link to the statute or regulation they come from. This is general information, not legal or tax advice, and rules change, so check the current text.
ERISA (29 U.S.C. Chapter 18)
The federal law that sets reporting, disclosure and fiduciary rules for employer-sponsored benefit plans.
COBRA Continuation Coverage (29 U.S.C. 1161)
Requires many group health plans to offer temporary continuation coverage after a qualifying event.
HIPAA Privacy Rule (45 CFR Part 164)
Federal privacy and security standards for protected health information held by health plans.
Family and Medical Leave Act (29 U.S.C. Chapter 28)
Job-protected leave and group health coverage continuation for eligible employees.
Americans with Disabilities Act (42 U.S.C. Chapter 126)
Prohibits disability discrimination in employment and other areas.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents, two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
An independent employee benefits consulting firm. We look at the entire benefits program — cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →