HIPAA protects the health information your plan handles.
The HIPAA Privacy Rule sets federal standards for how health plans and their business associates use and disclose protected health information.
The Basics for Employers.
A plain-English summary. This is general information, not legal advice, and the rules change, so check the current text.
What Is Covered
Protected health information held by group health plans, insurers and their business associates falls under the rule.
Employer Role
Employers that sponsor a plan need safeguards that keep plan information separate from employment decisions.
Notices and Agreements
Plans provide a notice of privacy practices and use business associate agreements with vendors that handle the information.
How it plays out.
HIPAA’s privacy and security rules apply to group health plans and to certain people who handle plan information. They do not apply to an employer simply because it has employees. The line is between the employer in its role as an employer and the plan as a separate covered entity.
In practice, health information about plan claims should stay in the plan’s hands, with limited access for the employer to administer the plan. HR staff who see claim details need clear rules about what they can see and why.
Insured plans often have a lighter burden than self-funded plans, because the carrier handles most of the information. Even so, a plan that receives enrollment or summary data should know what it is and how it is protected.
Where This Shows Up in Your Plan.
ERISA, ACA Reporting and Form 5500 Support
How we help with the filings, notices and plan documents.
Employer Benefits Guides: Eligibility, Plan Design, Life Events and Rules
Eligibility, plan design and life-event rules in one place.
Basic steps.
Identify Who Sees PHI
List the people who handle plan claim information.
Limit Access
Give access only to what each role needs.
Train the Team
Make sure staff know the rules.
Check Vendor Agreements
Confirm business associate agreements are in place.
Mistakes to avoid.
Mixing Employment and Plan Records
Keep health plan information out of personnel files.
Open Spreadsheets
Claim data in unprotected files is a common exposure.
No Training
Staff cannot follow rules they have not seen.
Other Rules Employers Work With.
Creditable Prescription Coverage
42 CFR 423.56
Cafeteria Plans
26 U.S.C. 125
Health Savings Accounts
26 U.S.C. 223
Laws and Rules Referenced
HIPAA Privacy Rule (45 CFR Part 164) — The statute or rule text from its official or public source.
An independent employee benefits consulting firm. We look at the entire benefits program — cost, plan performance, risk and administration.
Switch to CFH. Unhappy with your broker? Your employees won’t notice. You will. →
Cookies on This Site
We use cookies to keep the site working properly and to understand how it is used. You can decline anything that is not essential. See our Privacy Policy for the detail.
- Essential — needed for the site to load and for you to move around it. These cannot be switched off.
- Analytics — tell us which pages get read, so we know what is worth writing more of.
- Advertising — set by third parties such as ad and social platforms to measure and target campaigns.