HIPAA and privacy for employer health plans, in one place.
HIPAA governs how a group health plan handles members’ health information, and it reaches the vendors that touch that information. This page connects the basics, the cyber and vendor risks, and the newer questions around AI.
Three areas, and the page for each.
HIPAA Basics
What HIPAA means for an employer that sponsors a health plan.
Cyber And Vendor Risk
Securing the vendors and systems that hold plan data.
AI In Employee Benefits
What employers need to know about vendor risk when AI is involved.
Read next.
HIPAA For Employers
The plan sponsor’s responsibilities.
Cybersecurity For Employer Health Plans
HIPAA, vendors and breach readiness.
AI In Employee Benefits
What employers need to know about vendor risk.
Business Associate Agreements
What a vendor agreement must cover.
HIPAA Breach Notification
Steps and deadlines when plan information is exposed.
HIPAA For The Plan Sponsor
Employer records versus plan information.
HIPAA Security Rule
Safeguards for electronic plan information.
Minimum Necessary Standard
Who at the company sees plan information.
HIPAA Authorizations
When the plan needs written permission.
HIPAA Individual Rights
What your plan owes employees who ask.
HIPAA Notice Of Privacy Practices
Who must give one and how often.
HIPAA And Wellness Programs
When the rules apply.
Email And Text Under HIPAA
Reasonable safeguards for plan information.
Reproductive Health Privacy Rule Update
What still applies to your plan.
HIPAA Training, Sanctions And Records
The administrative duties employers skip.
Part 2 Substance Use Records
What changed for plans that receive them.
HIPAA Nondiscrimination
The health factors a plan cannot use.
Family Members And Personal Representatives
When a spouse, parent or friend calls.
Cloud Vendors And HIPAA
Why encryption does not remove the vendor from the rules.
Ransomware And HIPAA
When an attack is a breach.
Summary And De-Identified Data
What an employer can see.
HIPAA Enforcement And Penalty Tiers
How penalties are tiered.
How An OCR HIPAA Complaint Works
The complaint process and outcomes.
HIPAA Permitted Uses: Treatment, Payment And Operations
What needs no authorization.
HIPAA And State Law
When a state law is stricter.
HIPAA Marketing And Psychotherapy Notes
Uses that need written authorization.
Who HIPAA Applies To In The Employer Plan Context
Covered Entity
A covered entity is a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in standard transactions.
Group Health Plans Count
A group health plan is an ERISA plan that provides medical care, whether insured or self funded.
The Small Self Administered Exception
A plan with fewer than 50 participants that is administered by the employer that established it falls outside the definition.
Business Associates
A business associate handles protected health information for a covered entity, for functions such as claims, billing or quality assurance, and includes subcontractors.
Protected Health Information
PHI is individually identifiable health information in any form, and it excludes certain employment records held by a covered entity as employer.
Know Which Role Applies
We can help you with working out whether your plan, your vendors and your internal staff are covered entities, business associates or neither.
Source: 45 CFR 160.103.
Common Questions About HIPAA And Privacy
Does HIPAA apply to our health plan?
Yes. A group health plan is a covered entity under HIPAA. The HIPAA page explains what that means for the employer that sponsors it.
Does HIPAA apply to the employer’s own records?
Not in the same way. Employment records are generally outside HIPAA, while information held by the plan is covered. Ask us if you are unsure which category a record falls into.
What if a vendor has a breach?
Individuals must generally be notified without unreasonable delay and no later than 60 days after the breach is discovered. The cybersecurity page covers vendor oversight and readiness.
Do vendor contracts matter?
Yes. Vendors that handle plan information on the plan’s behalf are business associates, and the relationship should be covered by a written agreement.
Does using AI tools change the picture?
It adds vendor risk. The AI page covers what to ask before plan data is shared with an AI-enabled service.
Is this legal advice?
No. For a question specific to your company, involve your counsel. We can help you frame the question and bring the plan facts.
Send us your renewal.
We’ll tell you whether it looks competitive, where we see opportunity, and the five questions we’d put to your carrier. No cost, and no obligation to move anything.
The renewal letter
Your current plan summary
Contribution split by tier
Enrolled counts by tier
Four documents — two more if your group is 50 or more. Nothing else; every extra one is a reason to postpone.
An independent employee benefits consulting firm. We look at the entire benefits program: cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential: needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics: tell us which pages get read, so we know what is worth writing more of.
- Advertising: set by third parties such as ad and social platforms to measure and target campaigns.