12.3 COBRA, HIPAA, and Continuation

COBRA — Federal Continuation

The Consolidated Omnibus Budget Reconciliation Act (COBRA) lets covered employees and dependents continue group health coverage after it would otherwise end. COBRA applies to employers with 20 or more employees (smaller employers are governed by state mini-COBRA continuation laws).

Key mechanics tested on the exam:

• The beneficiary pays the full premium plus up to a 2% administrative load — i.e., up to 102% of the group cost. This is usually far higher than the employee paid while active, because the employer no longer contributes.
• Coverage is identical to the active plan — same benefits, same network.
• COBRA is continuation of the group plan, not conversion to an individual policy.

COBRA Qualifying Events and Duration

The maximum continuation period depends on the qualifying event and who is affected:

Memory hook: termination and reduced hours = 18 months; everything tied to the family losing the employee (death, divorce, dependency, Medicare) = 36 months; SSA-disability extends the 18 to 29 months. The plan must notify the employee of rights; the qualified beneficiary then has 60 days to elect and 45 days after electing to make the first payment. Gross misconduct termination is not a qualifying event — a classic trap.

HIPAA — Portability and Privacy

The Health Insurance Portability and Accountability Act (HIPAA) does two exam-relevant things:

1. Portability/non-discrimination — group plans may not deny eligibility or charge an individual more based on health status. Under the ACA, pre-existing condition exclusions are prohibited entirely, so HIPAA's old creditable-coverage credit toward a pre-ex period is now largely moot, but the guaranteed-issue and no-health-rating principles remain tested.
2. Privacy — Protected Health Information (PHI) must be safeguarded; disclosure requires authorization except for treatment, payment, and operations.

HIPAA also guarantees that small employers (generally 2–50) have guaranteed access to group coverage — insurers in the small-group market must issue regardless of group health.

PHI, Authorizations, and Penalties

HIPAA's Privacy Rule restricts how covered entities (insurers, providers, clearinghouses) and their business associates use and disclose Protected Health Information (PHI). PHI may be used without authorization for treatment, payment, and health-care operations (TPO), but most other disclosures require a signed authorization from the individual. Patients also have the right to access and amend their records and to receive a Notice of Privacy Practices.

Violations carry tiered civil penalties scaling with culpability, and willful neglect can trigger criminal liability. For producers, the operational rule is simple: never share a client's medical information with a third party — including a spouse or employer — without written authorization, and store applications and medical questionnaires securely. The Security Rule adds administrative, physical, and technical safeguards for electronic PHI (ePHI), which is why agency systems require access controls and encryption.

Continuation vs. Conversion — Don't Confuse Them

Students routinely mix these up:

• Continuation (COBRA/state mini-COBRA) keeps the person on the group plan temporarily (18/29/36 months) at up to 102% of group cost.
• Conversion moves the person to a new individual policy with no time limit, at individual rates, when continuation ends or for those without COBRA rights.

Worked example: A worker earning group coverage at $150/month (employer paid $600) is laid off. The full group cost is $750. Under COBRA she pays up to $750 × 1.02 = $765/month. She may elect COBRA for up to 18 months; if later determined disabled by the SSA within 60 days of the event, the period extends to 29 months. When COBRA ends, she may convert to an individual policy without proving insurability if she acts within the conversion window.

Deadlines, Termination, and State Mini-COBRA

COBRA runs on a chain of deadlines candidates must memorize:

COBRA coverage can terminate early if the beneficiary fails to pay, becomes covered under another group plan, becomes entitled to Medicare, or the employer ceases to maintain any group health plan.

State mini-COBRA laws extend similar continuation rights to employees of small employers (fewer than 20) that federal COBRA does not reach; duration and load percentages vary by state, so producers must check the applicable statute. A frequent trap: a beneficiary who gains new group coverage with no pre-existing limitation loses the right to keep COBRA, because the protection it was designed to provide is no longer needed.