HIPAA-Responsibilities-Frequently Asked Questions

HIPAA is at the forefront of many employers minds. As many are struggling to comply, hopefully some of the following questions and answers from HHS Website will help.  

What Is Health Information Privacy

Answer:

The HIPAA Privacy Rule provides federal protections for individually identifiable health information held by covered entities and their business associates and gives patients an array of rights with respect to that information. At the same time, the Privacy Rule is balanced so that it permits the disclosure of health information needed for patient care and other important purposes. 

The Security Rule specifies a series of administrative, physical, and technical safeguards for covered entities and their business associates to use to assure the confidentiality, integrity, and availability of electronic protected health information.

Who must comply with HIPAA privacy standards?

Answer:

As required by Congress in HIPAA, the Privacy Rule covers:

• Health plans
• Health care clearinghouses
• Health care providers who conduct certain financial and administrative transactions electronically. These electronic transactions are those for which standards have been adopted by the Secretary under HIPAA, such as electronic billing and fund transfers.

These entities (collectively called “covered entities”) are bound by the privacy standards even if they contract with others (called “business associates”) to perform some of their essential functions. The law does not give the Department of Health and Human Services (HHS) the authority to regulate other types of private businesses or public agencies through this regulation. For example, HHS does not have the authority to regulate employers, life insurance companies, or public agencies that deliver social security or welfare benefits. See our business associate section and the frequently asked questions about business associates for a more detailed discussion of the covered entities’ responsibilities when they engage others to perform essential functions or services for them.

I’m an employer that offers a fully insured group health plan for my employees. Is the fully insured group health plan subject to all of the Privacy Rule provisions?

Answer:

The Privacy Rule recognizes that certain fully insured group health plans may not need to satisfy all of the requirements of the Privacy Rule since these responsibilities will be carried out by the health insurance issuer or HMO with which the group health plan has contracted for coverage of its members. In particular, a fully insured group health plan that does not create or receive protected health information other than summary health information (see definition at 45 CFR 164.504(a) (GPO)) and enrollment or disenrollment information is not required to have or provide a notice of privacy practices. See 45 CFR 164.520(a)(2) (GPO).

Moreover, these group health plans are exempt from most of the administrative responsibilities under the Privacy Rule. See 45 CFR 164.530(k). These health plans are still required, however, to refrain from intimidating or retaliatory acts (45 CFR 164.530(g) (GPO)), and from requiring an individual to waive their privacy rights (45 CFR 164.530(h) (GPO)). The documentation requirements at 45 CFR 164.530(j) apply to these group health plans only to the extent of amendments, if any, made to the plan documents for the sharing of information with the plan sponsor under 45 CFR 164.504(f) (GPO). Additional information about the Privacy Rule, including guidance and technical assistance materials is available through the Department of Health and Human Services Office for Civil Rights Web site.

Must all small health plans comply with the Privacy Rule?

Answer:

No. Certain plans are specifically excluded from having to comply with the HIPAA Administrative Simplification requirements, including the Privacy Rule. See 45 CFR 160.103 (GPO). An employee welfare benefit plan that has less than 50 participants and is administered by the employer that establishes and maintains the plan is not a HIPAA covered entity. These plans, therefore, are not subject to the Privacy Rule. For additional information regarding compliance with the Privacy Rule, see the Office for Civil Rights Web site.

Are the following types of insurance covered under HIPAA: long/short term disability; workers' compensation; automobile liability that includes coverage for medical payments?

Answer:

No, the listed types of policies are not health plans. The HIPAA Administrative Simplification regulations specifically exclude from the definition of a “health plan” any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits, which are listed in section 2791(c)(1) of the Public Health Service Act, 42 U.S.C. 300gg-91(c)(1). See 45 CFR 160.103. As described in the statute, excepted benefits are one or more (or any combination thereof) of the following policies, plans or programs:

• Coverage only for accident, or disability income insurance, or any combination thereof.
• Coverage issued as a supplement to liability insurance.
• Liability insurance, including general liability insurance and automobile liability insurance.
• Workers’ compensation or similar insurance.
• Automobile medical payment insurance.
• Credit-only insurance.
• Coverage for on-site medical clinics
• Other similar insurance coverage, specified in regulations, under which benefits for medical care are secondary or incidental to other insurance benefits.

What Is Protected Health Information (PHI)?

Answer:

The Privacy Rule defines PHI as individually identifiable health information, held or maintained by a covered entity or its business associates acting for the covered entity, that is transmitted or maintained in any form or medium (including the individually identifiable health information of non-U.S. citizens). This includes identifiable demographic and other information relating to the past, present, or future physical or mental health or condition of an individual, or the provision or payment of health care to an individual that is created or received by a health care provider, health plan, employer, or health care clearinghouse. For purposes of the Privacy Rule, genetic information is considered to be health information.

For Covered Entities and Business Associates

The HIPAA Rules apply to covered entities and business associates.  

Individuals, organizations, and agencies that meet the definition of a covered entity under HIPAA must comply with the Rules' requirements to protect the privacy and security of health information and must provide individuals with certain rights with respect to their health information. If a covered entity engages a business associate to help it carry out its health care activities and functions, the covered entity must have a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do and requires the business associate to comply with the Rules’ requirements to protect the privacy and security of protected health information. In addition to these contractual obligations, business associates are directly liable for compliance with certain provisions of the HIPAA Rules.

If an entity  does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules.  See definitions of “business associate” and “covered entity” at 45 CFR 160.103.

COURT BARS PPACA AID FOR FEDERAL EXCHANGE SHOPPERS

By Andrew Zajac
July 22 (Bloomberg)

President Barack Obama’s health care overhaul suffered a potentially crippling blow as a U.S. appeals court ruled the government can’t give financial assistance to anyone buying
coverage on the insurance marketplace run by federal authorities.  

The decision, if it withstands appeals, may deprive more than half the people who signed up for the Patient Protection and Affordable Care Act the tax credits they need to buy a health plan.

The way PPACA is written makes clear that the subsidy is available only to people who
bought plans on state-run exchanges, a three-judge panel in Washington ruled today.

Only 14 states have opted to set up their own marketplaces, making delivery of tax credits via
the federal exchange crucial to meeting Obamacare’s goal of broadening health-care coverage
in the U.S.

“A very large share of people need the subsidies,” said Robert Blendon, a professor of health
policy at the Harvard School of Public Health in Boston.

If the ruling isn’t overturned, “it basically would significantly cripple the law,” Blendon said in an
interview before the ruling.

EVERY COMPANY THAT OFFERS EMPLOYEE BENEFITS SHOULD HAVE A SUMMARY PLAN DESCRIPTION AND PLAN DOCUMENT....OR ELSE

If you have medical, dental, vision, Employee Assistance Program, Flexible Spending Account (FSA), Health Reimbursement Arrangement (HRA), Life Insurance, Short or Long Term Disability plans, the Department of Labor may be knocking on your door asking for a Summary Plan Description (SPD) and Plan Document. They will want to know when you distributed the SPD to your employees and how.  If you can't provide this information in a timely fashion you may be fined up to $110 per day.

A SPD is an outline of an employee benefit plan(s) provided under ERISA and listed above.  It contains information such as the plan administrator, requirements for eligibility and participation in the plan(s), circumstances that result in disqualification or denial of benefits and identity of insurers administering the plan.

Oftentimes employers believe this is the responsibility of the insurance company but it is actually the employer who must make sure they are compliant.  Medical, Dental, Vision Insurance companies will issue Certificates of Coverage which may have a great deal of the information that a SPD will have but will usually fall short of the needed language.  

Typically with employers of less than 500 employees they will use a "Wrap-Around Plan" which creates a single document for all insured benefits.  

If you do not have this in place, you need to get this done as the Department of Labor is starting to audit companies with more tenacity and looking for those dollars to fund the ACA .  Costs can range from $200 to $1000 or more.

IRS Regulations Clarify Employer ACA Reporting Requirements-Long but important!

IRS Regulations Clarify Employer ACA Reporting Requirements

by: Mary Bauman

June 4, 2014

The IRS issued final regulations in March designed to simplify the employer reporting requirements imposed by the Affordable Care Act. Most importantly, the regulations permit combined reporting for the multiple requirements and simplify reporting where a large employer provides affordable group health coverage, which is of minimum value to almost all of its employees. This Q&A explains the new regulations and how they impact both small and large employers.

What are the reporting requirements?

The ACA added two sections to the Internal Revenue Code related to reporting. First, Section 6055 requires health insurers and employers sponsoring self-funded group health plans to annually report to the IRS and to responsible individuals (the enrolled employees), whether the coverage constitutes minimum essential coverage under the ACA. This reporting requirement will help the IRS to enforce the individual mandate penalty. We refer to this as “individual mandate reporting.”

Second, Section 6056 requires large employers with 50 or more full-time and full-time equivalent employees to report to the IRS and to full-time employees for two purposes:

• To assist the IRS with enforcing the employer pay-or-play penalty; and
• To assist full-time employees with determining their eligibility for a premium credit. It should be noted that even though mid-size employers with 50 to 99 full-time employees are not subject to pay or play for 2015, these employers are still subject to Section 6056 reporting for 2015 (and later years).  We refer to this as “pay or play reporting.”

Both reporting requirements were initially required under the ACA with respect to the 2014 calendar year. However, the effective date was delayed last year. Now, the first year for which reporting is required is 2015, with the reporting for 2015 due during the first quarter of 2016.

Are small employers subject to the reporting requirements?

Generally, no. Small employers with less than 50 full-time employees are not subject to pay-or-play reporting. And only small employers that sponsor self-funded group health plans are subject to individual mandate reporting. For small employers that sponsor fully insured plans, it is the insurer that is responsible for the individual mandate reporting.

What are the basic rules for large employers?

As with small employers, if a large employer’s group health plan is fully insured, the insurer will be responsible for the individual mandate reporting. The large employer will only be responsible for pay-or-play reporting. On the other hand, if the large employer sponsors a self-funded group health plan, the employer will be responsible for both the individual mandate and pay-or-play reporting. Under the new regulations, a large employer can satisfy both reporting requirements on a combined basis by using IRS Form 1095–C (the employee statements), along with IRS Form 1094-C (the transmittal form). The IRS is planning to release a draft version of the reporting forms in the near future.

For individual mandate reporting, the reports must include the Social Security number, or a shortened version of it, for the responsible individuals (the enrolled employees) and their enrolled dependents. However, if, after reasonable efforts, the Social Security number of an individual cannot be obtained (for example, in the case of a dependent), the individual’s date of birth may be used. The individual mandate reports must also include the months for which the individual is enrolled for at least one day during the month.

Pay-or-play reporting focuses on the employer’s full-time employees. All of the following information must be reported:

• A certification as to whether the large employer offered its full-time employees and their dependents the opportunity to enroll in coverage (by calendar month).
• The number of full-time employees for each calendar month.
• For each full-time employee, the months for which coverage was available and the employee-only premium for the lowest cost medical option providing minimum value.
• The name, address and Social Security number of each full-time employee.
• The months during which the employee was covered under the employer’s group health plan.

Are any simplified reporting options available?

Yes.  The final regulations provide the following simplified pay-or-play reporting options:

1. Qualifying offers. Instead of reporting all of the information described above on a month-by-month basis, employers are permitted to report an employee’s name, address, Social Security number and indicator code for each full-time employee who receives a “qualifying offer” of coverage for all 12 months. (The indicator code is used to convey certain information about the employee, similar to the code used on the W-2). This simplified reporting option is not available for full-time employees who don’t receive a qualifying offer for all 12 months of the year.

A “qualifying offer” means:

• The employee-only option is affordable (using the federal poverty line safe harbor) and of minimum value.
  • Coverage is also offered to the employee’s spouse and dependents.  

2. Transition Relief for 2015. For 2015 only, if a large employer certifies to the IRS that it has made a “qualifying offer” (as described above) to at least 95% of its full-time employees, the employer may use the simplified reporting option for all full-time employees, including those full-time employees who didn’t receive a qualifying offer for 12 months.

3. 98% offer. If a large employer certifies to the IRS that it offers coverage that is of minimum value and affordable (using any affordability safe harbor) to at least 98% of its full-time employees, it is not required to report any further information to the IRS. However, the employer must still satisfy the reporting requirement – sending a statement to each full-time employee.

What are the reporting deadlines?

Like income taxes, reporting to the IRS is due annually (even though the reports must include information on a monthly basis) – after the end of the calendar year to which the report relates. If the employer is required to file statements for 250 or more employees, the filing must be made electronically with the IRS and the deadline for filing reports is no later than March 31 following the calendar year to which the reporting relates. If the employee population is less than this threshold of 250 employees, employers have the option to file electronically or by mail.  The deadline for the electronic filing of statements with the IRS is March 31 and the deadline for filing by mail is by February 28 following the calendar year to which the reporting relates.

Statements to employees consist of an IRS form (1095–C) similar to the W-2 and are generally required to be sent by mail by January 31 following the calendar year to which the reporting relates. These employee statements can be mailed along with their W-2s. Employers may want to provide a cover memo of explanation, particularly for the first year when this form is new to employees.

Bauman is an attorney at law with Miller Johnson in Grand Rapids, Mich.

PPACA costs fall as premiums beat forecast

April 14 (Bloomberg) -- The health law will cost $104 billion less over the next decade, the Congressional Budget Office said after premiums for private Obamacare plans came in lower than the agency expected.

The premium for a benchmark “silver” level plan, the second-most generous available, will average $4,400 in 2016, the CBO said today in a report – 15 percent less than it forecast in 2009. The budget office reports regularly on the economic effects of the law.

About 6 million people on average are expected to be enrolled in 2014 in private health plans through insurance exchanges created by the Patient Protection and Affordable Care Act, the budget agency said. The U.S. health secretary, Kathleen Sebelius, said last week that 7.5 million people signed up for private plans with enrollment set to end tomorrow.

White House press secretary Jay Carney called the CBO report “welcome news.”

“It shows that marketplace health-care costs have gone down, because premium estimates have gone down,” he told reporters in a briefing.

Sebelius’s enrollment figure exceeded an initial CBO estimate of 7 million made before the exchanges opened Oct. 1 and technology failures prevented millions from immediately signing up. In February, the agency revised its estimate to 6 million.

Imprecise statistics

The estimate “cannot be compared directly with the number of people who have enrolled through the exchanges as of any given date,” according to the CBO report. “The number of people who will have coverage through the exchanges in 2014 will not be known precisely until after the year has ended.”

President Barack Obama on April 11 credited Sebelius with the turn-around when he announced his nominee to replace her, White House budget director Sylvia Mathews Burwell.

The CBO’s latest estimate is for all of 2014 and includes people who are able to sign up or leave coverage after April 15 because of life-changing events such as marriage or losing a job. The agency said that 7 million would also join Medicaid, the government program for low-income people that is being expanded in 26 states, a decrease of 1 million since February.

The total number of people enrolled in exchange plans at any point during the year may be higher than the CBO’s estimate of 6 million on average “because some people will be covered for only part of the year,” the budget agency said in a report.

Declining subsidies

The agency said it reduced its estimate of the cost of the program because it anticipates the government will provide less in subsidies that help people pay premiums for the Affordable Care Act plans. The government will pay $17 billion this year, a $3 billion decrease from its February estimate, the agency said. The aid, available to people earning less than four times the poverty level, or about $95,000 for a family of four, will cost about $1 trillion through 2024, the CBO said in its report, a reduction of about $200 billion since February.

The budget office said premiums are expected to rise more rapidly after 2016, at about a 6 percent annual rate, to $6,900 on average for the benchmark silver-level plan in 2024.

While the Medicaid expansion is expected to cost $20 billion in the first year, an increase of $1 billion from the February estimate, the projected cost of $792 billion through 2024 is unchanged.

The CBO said it expects fewer Americans and employers to pay fines to the government for not carrying insurance or offering it to their workers, a loss of revenue that somewhat offsets the reduction in the cost of subsidies.

Penalty revenue

Penalty payments for violating the law’s requirement that people carry insurance, known as the individual mandate, will total $46 billion in the next decade from an estimate of $52 billion in February. Revenue expected to be collected from employers that refuse to offer insurance totals $139 billion over a decade compared with $151 billion forecast in February.

Many people who refuse to buy insurance this year will be able to avoid paying fines because of a series of exceptions the Obama administration has created. The same is true for businesses, which aren’t required to cover any of their workers next year unless they employ 100 people or more.

BY ALEX WAYNE

April 14, 2014

Last-Day Rush Causes Another Malfunction of HealthCare.gov

By DAVID S. JOACHIMMARCH 31, 2014

WASHINGTON — For a second time on Monday, the federal website where consumers can sign up for medical coverage under President Obama’s health care law unexpectedly stopped taking applications. It is the last day of open enrollment for the year.

Aaron Albright, a spokesman for the Department of Health and Human Services, indicated that the second failure occurred shortly after noon, and that it seemed to be caused by a flood of traffic on the site, HealthCare.gov. Earlier, he had said that the first failure, for about three hours in the morning, was caused by a software error unrelated to traffic volume. By 1:40 p.m., Mr. Albright said the site was functioning normally again.

Before the second failure was fixed, he released a statement that said: “There are a record number of people trying to access HealthCare.gov right now — more than 100,000 people concurrently in the system as of noon. The tech team monitoring HealthCare.gov in real time has identified an issue with users creating new accounts. The application and enrollment tools are unavailable to new users at the moment. The tech team is working to resolve the issue as quickly as possible.”Although the sign-up functions were disabled, other parts of the site were functioning normally, Mr. Albright said. That included the Data Services Hub, which verifies data entered by consumers against federal databases at agencies including the Internal Revenue Service and the Social Security Administration.

Mr. Albright said that consumers who had started applications would be able to complete their enrollment after the latest problem was fixed. On Monday morning, the enrollment system on HealthCare.gov was taken offline for scheduled maintenance between 1 a.m. and 5 a.m., but then remained down for several more hours because of a software bug discovered by technology personnel during maintenance.A surge of traffic has hit HealthCare.gov in the final days of open enrollment, the administration has said.

Last week, the administration said it would extend the deadline for people who tried to apply but were blocked by technical problems with the site. It also said that it had exceeded its revised goal of signing up six million people over the federal exchange and similar sites run by the states.

The White House press secretary, Jay Carney, said during his daily briefing on Monday that he was not sure when final enrollment figures would be available. But, he said, “here on the last day of enrollment, we’re looking at a number substantially larger than six million people enrolled.”

White House Says ACA Enrollment Has Hit Their Revised Lower Goal of Six Million

White House Says Health Care Rolls Top Goal: 6 Million

By DAVID S. JOACHIM MARCH 27, 2014

WASHINGTON — The White House said on Thursday that more than six

million people had signed up for medical insurance plans under President

Obama’s health care law, exceeding the administration’s revised goal for

enrollment by the Monday deadline.

Demand for new policies has surged in recent days as the open

enrollment period draws to a close, the White House said, with 1.5 million

visits to HealthCare.gov and 430,000 calls to the program’s call centers on

Wednesday alone. The enrollment figure is up from five million a week

ago.

Mr. Obama, who was traveling in Italy, held a conference call to thank

volunteers who are helping to enroll uninsured Americans, officials said.

“The president encouraged the navigators and volunteers to redouble

their efforts over the next four days and leave no stone unturned in trying

to bring affordable health coverage to as many Americans as possible,”

White House officials said in describing the call.

Enrollment began in October. The administration recently scaled back

its original estimate of signing up seven million people.

Republican lawmakers have played down the enrollment numbers and

continued to press for an overhaul or a repeal of the law. Even some

Democratic senators in competitive re-election races have prescribed changes to the law.

Some conservative commentators took to Twitter on Thursday to ask

how many of the six million enrollees had paid their insurance premiums.

The White House has not been willing to say.

© 2014 The New York Times Company