4.3 HIPAA Portability, Privacy, and Security for Group Health Plans

HIPAA Portability, Privacy, and Security for Group Health Plans

Quick Answer: The Health Insurance Portability and Accountability Act of 1996 (HIPAA, P.L. 104-191) and the HITECH Act of 2009 establish a federal regulatory framework for group health plans spanning three core domains: (1) Portability & Nondiscrimination (mandating 30- and 60-day Special Enrollment Periods and banning health-status discrimination), (2) The Privacy Rule (protecting Protected Health Information, enforcing the "minimum necessary" standard, requiring Business Associate Agreements, and mandating employer firewalls), and (3) The Security & Breach Rules (mandating administrative, physical, and technical safeguards for ePHI and strict 60-day breach notifications).

---

1. Portability Provisions, Special Enrollment Periods & Nondiscrimination

While the ACA eliminated pre-existing condition exclusions and certificates of creditable coverage for group health plans, HIPAA's core portability, special enrollment, and nondiscrimination provisions remain active federal law under ERISA Title I (Part 7), IRC Chapter 100 (§9801–§9802), and PHSA Title XXVII.

┌────────────────────────────────────────────────────────────────────────┐
│                     HIPAA SPECIAL ENROLLMENT PERIODS (SEPs)            │
├───────────────────────────────────┬────────────────────────────────────┤
│ Loss of Other Group/Individual    │ Must request enrollment within     │
│ Minimum Essential Coverage        │ 30 calendar days of coverage loss  │
├───────────────────────────────────┼────────────────────────────────────┤
│ Acquisition of New Dependent      │ Must request enrollment within     │
│ (Marriage, Birth, Adoption)       │ 30 calendar days of the event      │
├───────────────────────────────────┼────────────────────────────────────┤
│ Medicaid / CHIP Termination or    │ Must request enrollment within     │
│ Premium Assistance Eligibility    │ 60 calendar days of event          │
└───────────────────────────────────┴────────────────────────────────────┘

Statutory Special Enrollment Triggers

Group health plans must provide Special Enrollment Periods (SEPs) allowing eligible employees and dependents to enroll outside of the standard annual open enrollment window:

1. Loss of Other Coverage (30-Day SEP): An employee or dependent who previously declined group coverage because they were covered under another plan (e.g., spouse's employer plan, COBRA, individual policy) must be allowed to enroll within 30 calendar days of involuntarily losing that coverage (due to job loss, reduction in hours, employer contribution cessation, plan termination, or COBRA exhaustion).
2. Acquisition of New Dependent (30-Day SEP): When an employee gains a new dependent through marriage, birth, adoption, or placement for adoption, the plan must allow the employee, spouse, and newly acquired child to enroll within 30 calendar days of the qualifying event. Coverage for newborns and adopted children must be effective retroactively to the date of birth or adoption.
3. Medicaid / CHIP Special Enrollment (60-Day SEP): Codified by the Children's Health Insurance Program Reauthorization Act of 2009 (CHIPRA), plans must offer a 60-calendar-day SEP when:
   • An employee or dependent loses coverage under a state Medicaid or CHIP program; or
   • An employee or dependent becomes eligible for state premium assistance subsidies under Medicaid or CHIP to help purchase employer-sponsored coverage.

Health Factor Nondiscrimination (ERISA §702 / IRC §9802)

Group health plans are strictly prohibited from establishing rules for eligibility, enrollment periods, waiting periods, or premium contribution levels based on any of the eight statutory health factors:

• Health status, medical condition (physical or mental), claims experience, receipt of healthcare, medical history, genetic information, evidence of insurability, or disability.

Wellness Exception: Plans may offer premium discounts or cost-sharing adjustments through structured wellness programs, provided health-contingent programs offer reasonable alternatives, cap rewards at 30% of total coverage cost (50% for tobacco cessation), and satisfy annual qualification criteria.

---

2. The HIPAA Privacy Rule: PHI, Minimum Necessary & Sponsor Firewalls

The HIPAA Privacy Rule (45 CFR Part 160 and Part 164, Subparts A and E) governs the use and disclosure of Protected Health Information (PHI) by Covered Entities (group health plans, health insurance issuers, healthcare clearinghouses, healthcare providers) and their Business Associates.

┌────────────────────────────────────────────────────────────────────────┐
│                     HIPAA PRIVACY CORE FRAMEWORK                       │
├───────────────────────────────────┬────────────────────────────────────┤
│ Protected Health Information (PHI)│ Individually identifiable health   │
│                                   │ data across oral, paper, or e-form │
├───────────────────────────────────┼────────────────────────────────────┤
│ TPO Permitted Disclosures         │ Treatment, Payment, and Health     │
│                                   │ Care Operations (no auth needed)   │
├───────────────────────────────────┼────────────────────────────────────┤
│ Minimum Necessary Standard        │ Must limit PHI uses/requests to    │
│                                   │ smallest scope to achieve goal     │
├───────────────────────────────────┼────────────────────────────────────┤
│ Business Associate Agreement (BAA)│ Mandatory contract binding third-  │
│                                   │ party TPAs/PBMs/brokers to HIPAA   │
└───────────────────────────────────┴────────────────────────────────────┘

Protected Health Information (PHI) Defined

PHI encompasses any individually identifiable health information transmitted or maintained in any form or medium (electronic, paper, or oral) that is created or received by a covered entity, relating to:

• The past, present, or future physical or mental health condition of an individual;
• The provision of healthcare to an individual; or
• The past, present, or future payment for the provision of healthcare.

Excluded Data: Employment records held by a covered entity in its role as an employer (e.g., OSHA logs, FMLA medical certifications, drug test results, return-to-work notes) are explicitly excluded from the statutory definition of PHI, though they remain subject to ADA and state privacy protections.

Permitted Disclosures: Treatment, Payment, and Operations (TPO)

Covered entities may use and disclose PHI without individual signed authorization exclusively for TPO functions:

• Treatment: Coordination and management of healthcare by healthcare providers.
• Payment: Activities undertaken by a group health plan to obtain premiums, determine coverage, adjudicate claims, coordinate benefits (COB), subrogate, and manage reinsurance/stop-loss claims.
• Health Care Operations: Quality assessment, population health management, underwriting and premium rating, contract renewals, legal compliance, fraud/abuse detection, and business planning.

The Minimum Necessary Standard

When using, disclosing, or requesting PHI, a covered entity must make reasonable efforts to limit PHI to the minimum necessary required to accomplish the intended administrative or clinical purpose. The minimum necessary rule does not apply to disclosures to healthcare providers for treatment, disclosures made directly to the individual, or uses required by law.

Business Associate Agreements (BAAs)

A Business Associate (BA) is any external vendor or service provider that creates, receives, maintains, or transmits PHI on behalf of a group health plan (e.g., Third-Party Administrators [TPAs], Pharmacy Benefit Managers [PBMs], actuaries, brokers, legal counsel, cloud storage hosts). The plan must execute a formal Business Associate Agreement (BAA) contractually obligating the BA to implement HIPAA administrative, physical, and technical safeguards and report data breaches.

Plan Sponsor Firewalls & Employer Certification Rules

Under the law, the employer (corporate entity) and the group health plan are separate legal entities. An employer cannot access PHI from its own health plan for employment-related decisions (e.g., hiring, promotions, terminations) or for other non-health benefit programs.

┌────────────────────────────────────────────────────────────────────────┐
│                     PLAN SPONSOR FIREWALL ARCHITECTURE                 │
├────────────────────────────────────────────────────────────────────────┤
│ [ Corporate Employer / Plan Sponsor ]                                  │
│     │                                                                  │
│     ├──► Summary Health Information (SHI) / De-Identified Data ONLY    │
│     │    (For RFP bidding, stop-loss quotes, plan design changes)      │
│     │                                                                  │
│  ═══════════════ MANDATORY LEGAL & PHYSICAL FIREWALL ════════════════  │
│     │                                                                  │
│     ├──► Named Benefits Staff ONLY (Authorized for Plan Admin)        │
│     │    • Must amend Plan Document to restrict PHI use                │
│     │    • Formal Employer Certification to Plan                       │
│     │    • Strict physical/electronic access controls                  │
│     ▼                                                                  │
│ [ Group Health Plan / TPA / PHI Repository ]                           │
└────────────────────────────────────────────────────────────────────────┘

To receive detailed PHI for plan administration functions (e.g., handling complex claims appeals, auditing TPA performance), the plan sponsor must:

1. Amend Plan Documents: Establish formal provisions restricting PHI access solely to named employees or classes of employees performing designated plan administration functions.
2. Provide Formal Certification: The plan sponsor must certify to the group health plan that it will not use or disclose PHI for employment-related actions, will maintain physical and electronic access firewalls, will report any improper uses, and will ensure all agents agree to the same restrictions.
3. De-Identified Data Exception: Plan sponsors can freely receive Summary Health Information (SHI) (claims cost summaries stripped of personal identifiers) for the purpose of obtaining premium bids or modifying plan design, without formal plan amendments.

---

3. The HIPAA Security Rule: Safeguards for ePHI

The HIPAA Security Rule (45 CFR Part 160 and Part 164, Subpart C) establishes national technical and operational standards to ensure the confidentiality, integrity, and availability of all electronic Protected Health Information (ePHI).

Required vs. Addressable Specifications: "Required" specifications must be implemented exactly as written. "Addressable" specifications require the covered entity to evaluate whether the control is reasonable and appropriate, implementing either the specification, an equivalent alternative measure, or documenting why the standard is not applicable.

---

4. HITECH Act & Breach Notification Rules

The Health Information Technology for Economic and Clinical Health (HITECH) Act, enacted under ARRA in 2009, significantly expanded HIPAA enforcement, made Business Associates directly liable for compliance, and established strict statutory Breach Notification Rules (45 CFR §§ 164.400–414).

┌────────────────────────────────────────────────────────────────────────┐
│                     HITECH BREACH NOTIFICATION TIMELINES               │
├───────────────────────────────────┬────────────────────────────────────┤
│ Affected Individual Notice        │ Written notice via first-class mail│
│                                   │ within ≤ 60 calendar days          │
├───────────────────────────────────┼────────────────────────────────────┤
│ Major Breach (≥ 500 Individuals)  │ • Notice to HHS OCR ≤ 60 days      │
│                                   │ • Notice to Major Media ≤ 60 days  │
├───────────────────────────────────┼────────────────────────────────────┤
│ Minor Breach (< 500 Individuals)  │ • Annual electronic log to HHS OCR │
│                                   │   within 60 days of year-end       │
└───────────────────────────────────┴────────────────────────────────────┘

Statutory Definition of Breach & The 4-Factor Risk Assessment

A breach is defined as the acquisition, access, use, or disclosure of unencrypted PHI in a manner not permitted under the Privacy Rule that compromises the security or privacy of the data.

An improper acquisition of PHI is presumed to be a breach unless the covered entity or business associate demonstrates through a formal 4-Factor Risk Assessment that there is a low probability the PHI has been compromised:

1. The nature and extent of the PHI involved (types of identifiers, clinical diagnosis, financial account numbers);
2. The unauthorized person who used the PHI or to whom the disclosure was made;
3. Whether the PHI was actually viewed, acquired, or accessed; and
4. The extent to which the risk has been mitigated (e.g., immediate destruction, signed confidentiality confirmation).

Safe Harbor (Encryption): If ePHI is encrypted in accordance with NIST standards (e.g., AES-256) at rest and in transit, the lost or stolen media is considered secured data, and no statutory breach notification is required.

Mandatory Notification Timelines

• Individual Notice: The covered entity must provide written notice via first-class mail (or secure email if the individual consented) without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
• Breaches Affecting 500 or More Individuals:
  • The covered entity must notify prominent media outlets in the state or jurisdiction within 60 calendar days.
  • The covered entity must notify the HHS Secretary (via the OCR portal) immediately, without unreasonable delay and within 60 calendar days of discovery.
• Breaches Affecting Fewer than 500 Individuals:
  • The covered entity must notify affected individuals within 60 days.
  • The covered entity must log the breach and report it electronically to HHS OCR within 60 days after the end of the calendar year in which the breach occurred (by March 1).