13.3 Group Health, COBRA, and HIPAA Portability
Key Takeaways
- Group coverage uses a master contract issued to the employer; members receive certificates, not individual policies.
- COBRA generally applies to employers with 20+ employees and continues group coverage for 18, 29, or 36 months depending on the qualifying event.
- Under COBRA the qualified beneficiary pays up to 102% of the full group premium (150% during the 11-month disability extension).
- HIPAA guarantees portability, limits pre-existing exclusions, prohibits health-status discrimination, and protects health information privacy.
- Group underwriting evaluates the group as a whole, producing lower cost and broader guaranteed-issue access than individual coverage.
Group health insurance is issued to a sponsor — usually an employer — under a single master contract (master policy). Individual members are certificate holders, not policyowners; they receive a certificate of coverage summarizing their benefits.
Because the insurer underwrites the group as a whole rather than each person, group plans typically offer:
- Lower per-person cost (administrative efficiency and spread of risk),
- Guaranteed issue or simplified underwriting for eligible members,
- Experience or community rating that prices the group on its own or a pooled claims history.
Key distinction: In group insurance the contract is between the insurer and the employer. The employee's relationship is through the certificate, which is why continuation rights (COBRA) and portability rules (HIPAA) exist — they protect the individual when the employer relationship changes.
To qualify for favorable group treatment, a group generally must be formed for a purpose other than obtaining insurance — an employer-employee group, a labor union, a trade association, or a multiple-employer trust. This requirement, plus minimum participation thresholds (often 75% of eligible employees for contributory plans, 100% for noncontributory plans), guards against adverse selection, where only the unhealthy enroll. Spreading risk across a broad, employment-defined population is what lets group plans waive individual underwriting and still price competitively.
COBRA — Continuation of Coverage
The Consolidated Omnibus Budget Reconciliation Act (COBRA) lets qualified beneficiaries continue group health coverage after a qualifying event that would otherwise end it. COBRA generally applies to employers with 20 or more employees.
| Qualifying Event | Continuation Period |
|---|---|
| Voluntary or involuntary termination (not gross misconduct) | 18 months |
| Reduction in hours below eligibility | 18 months |
| Qualified beneficiary disabled (SSA-determined) during first 60 days | 29 months |
| Divorce, death of employee, child loses dependent status, employee Medicare entitlement | 36 months |
Premium rule: The qualified beneficiary may be charged up to 102% of the full group premium (the extra 2% covers administration). During the 11-month disability extension to 29 months, the charge may rise to 150%.
Worked example: A group plan's full monthly premium is $600. Under standard COBRA, the former employee can be billed up to $612 (102%). If a disability extension applies for the additional 11 months, the charge can reach $900 (150%).
An employee is terminated (not for gross misconduct) from a company subject to COBRA. For how many months may the employee elect to continue group health coverage, and at what maximum percentage of the group premium?
HIPAA — Portability, Access, and Privacy
The Health Insurance Portability and Accountability Act (HIPAA) strengthened the rights of people moving between health plans. Its core protections:
| HIPAA Protection | What It Does |
|---|---|
| Portability | Credits prior creditable coverage to reduce or eliminate new pre-existing exclusions |
| Guaranteed access | Restricts denial of group coverage based on health status |
| Nondiscrimination | Bars charging an individual more than similar members because of health factors |
| Privacy and security | The Privacy Rule and Security Rule protect Protected Health Information (PHI) |
Under HIPAA, a person who maintained creditable coverage without a significant break could reduce any pre-existing condition exclusion in a new group plan by the length of that prior coverage. The Affordable Care Act (ACA) later prohibited pre-existing condition exclusions outright for most plans, but the exam still tests HIPAA's portability framework.
Memory hook: HIPAA is the P-A-N-P law — Portability, Access, Nondiscrimination, Privacy. COBRA is about continuing the same job's plan; HIPAA is about carrying credit and protection into a new plan.
HIPAA's privacy framework is also tested. Protected Health Information (PHI) is individually identifiable health data held by a covered entity (health plans, providers, clearinghouses) or its business associates. The Privacy Rule limits use and disclosure of PHI to treatment, payment, and health-care operations unless the individual authorizes more; the Security Rule requires administrative, physical, and technical safeguards for electronic PHI. Violations carry civil and criminal penalties, which is why producers must handle client health data with care.
Eligibility, Enrollment, and Coordination
Group plans set eligibility rules (for example, full-time status and a waiting period) and an enrollment window. New hires enroll during their initial eligibility period; others wait for open enrollment unless a qualifying life event (marriage, birth, loss of other coverage) triggers a special enrollment period.
When a person is covered by two group plans, the Coordination of Benefits (COB) provision prevents collecting more than 100% of expenses. The primary plan pays first; the secondary plan pays the balance up to its limits.
COB scenario: A child is covered by both parents' plans. Under the birthday rule, the plan of the parent whose birthday falls earlier in the calendar year is primary. If that plan pays $700 of a $1,000 covered bill, the secondary plan may pay up to the remaining $300 — never more than the total expense.
Group conversion privileges may also let a departing member convert to an individual policy without evidence of insurability, complementing COBRA and HIPAA as a third continuation path.
Keep the three continuation paths straight. COBRA continues the same group plan temporarily, with the individual paying the full premium plus the administrative load. HIPAA carries protection and creditable-coverage credit into a new plan and guards privacy. Conversion turns group coverage into an individual contract going forward. Together they ensure that losing or leaving a job does not automatically mean losing all health coverage, which is the policy goal these federal rules were written to serve.
A child is covered as a dependent under both parents' group health plans. The mother's birthday is March 4 and the father's is September 12. Under the standard coordination-of-benefits birthday rule, which plan is primary?