Compliance Calendar
The largest health data breach on record happened at a vendor that sat between carriers and providers. For an employer, the lesson is that your plan’s security is mostly your vendors’ security, and the contract is where you control it.
Key takeaways
- An employer health plan is a HIPAA covered entity. The plan sponsor receives protected data and has obligations even when a carrier or administrator runs the plan.
- The 2024 Change Healthcare breach affected an estimated 192.7 million people. Covered entities remain responsible for breach notices, even if they delegate the sending.
- A proposed update to the HIPAA Security Rule, issued in January 2025, would require multifactor authentication, encryption and annual audits. It is not final.
What applies to you today
A group health plan is a covered entity under HIPAA. If the employer touches protected health information for plan administration, as most do when they handle enrollment, claims escalations or eligibility files, the employer needs safeguards, a firewall between plan data and employment decisions, and written agreements with the vendors that handle the data. Business associate agreements are required with carriers, administrators, brokers and other vendors. The rules for breach notice are fixed: a business associate must notify the covered entity within 60 days, individuals must be notified without unreasonable delay and no later than 60 days, and the Department of Health and Human Services must be told promptly for breaches affecting 500 or more people and annually for smaller ones.
The Department of Labor has said its cybersecurity guidance for ERISA plans also applies to health and welfare plans. It is not binding, but it is how a regulator will judge whether your process was prudent.
What the Change Healthcare breach showed
In 2024 attackers broke into the clearinghouse Change Healthcare, which processes claims for a large share of the U.S. system. HHS later reported an estimated 192.7 million people affected. For employers the damage was twofold: claims payments stalled for weeks, and plan sponsors had to work out who was responsible for notices. The answer under HIPAA is that the covered entity is ultimately responsible, although it can delegate the sending to the vendor in writing. That is why the business associate agreement matters.
What may be coming
In December 2024 HHS proposed a major update to the HIPAA Security Rule, published in January 2025. It would require encryption, multifactor authentication, an inventory of systems, a 72-hour restoration capability and annual compliance audits, and it would make business associate verification a formal requirement. The comment period closed in March 2025. The rule is not final, and the regulatory agenda reports we have seen push finalization well out, so we treat it as direction, not a deadline.
A vendor and plan checklist
- Confirm business associate agreements exist with every carrier, administrator, PBM, broker and technology vendor, with breach notice timelines and cyber insurance requirements
- Ask for current SOC 2 reports or equivalent third-party assurance
- Limit who receives eligibility and census files, send them only through secure transfer, and avoid email attachments
- Require multifactor authentication on every system that holds plan data
- Document an annual risk analysis for plan data, even if it is short
- Include plan data in your incident response plan and decide who calls whom
- Ask each vendor what happens to claims payment and enrollment if it goes offline for a week
Questions we get
Is the employer or the carrier responsible if the carrier is breached?
Both may have obligations. For a fully insured plan the carrier usually handles notices. For a self-funded plan the plan is the covered entity and remains responsible, so the contract with the administrator should spell out who does what.
Does cyber liability insurance cover this?
Possibly, but a standard policy may exclude plan-related losses. Ask your insurance advisor whether the plan or the plan sponsor is covered.
What is the first step?
Make a list of every vendor that receives enrollment or claims data, and check that each has a signed business associate agreement.
Sources: HIPAA Privacy, Security and Breach Notification Rules; HHS statements on the Change Healthcare incident; HIPAA Security Rule proposed rule (January 6, 2025); Department of Labor cybersecurity guidance. This is general information and not legal advice.
Related Reading
Want a vendor data-sharing review? Send us your renewal and we will map who gets your eligibility files and what agreements are in place.
