12.3 COBRA, HIPAA, and Continuation
Key Takeaways
- COBRA applies to employers with 20 or more employees and lets qualified beneficiaries continue group coverage at up to 102% of the full premium.
- Continuation runs 18 months for termination/reduced hours and 36 months for events like divorce, death, or a child losing dependent status.
- The employer notifies the plan within 30 days of a qualifying event; the qualified beneficiary then has 60 days to elect.
- HIPAA limits pre-existing condition exclusions, guarantees portability/creditable coverage, and protects health information privacy.
- A disability extension can lengthen COBRA from 18 to 29 months, allowing the plan to charge up to 150% of the premium during the extension.
When group coverage would otherwise end, federal law gives many people a right to keep it temporarily. COBRA (Consolidated Omnibus Budget Reconciliation Act) governs continuation; HIPAA governs portability and privacy. The exam tests the size threshold, durations, percentages, and notice deadlines precisely, so memorize the numbers.
COBRA Basics
| Element | Rule |
|---|---|
| Employer size | 20 or more employees (prior year) |
| Premium | Up to 102% of the full group premium (100% + 2% admin) |
| Who qualifies | Qualified beneficiaries: covered employee, spouse, dependent children |
| Coverage | Identical to active-employee coverage |
Note: COBRA applies to private employers with 20+ employees and to state/local governments. Smaller-employer continuation may be governed by state "mini-COBRA" laws.
Qualifying Events and Duration
The length of continuation depends on the qualifying event. Two durations dominate the exam: 18 months and 36 months.
| Qualifying event | Qualified beneficiary | Max duration |
|---|---|---|
| Voluntary/involuntary termination (not gross misconduct) | Employee + dependents | 18 months |
| Reduction in hours below eligibility | Employee + dependents | 18 months |
| Employee becomes Medicare-entitled | Spouse/dependents | 36 months |
| Divorce or legal separation | Spouse | 36 months |
| Death of covered employee | Spouse/dependents | 36 months |
| Child loses dependent status | Child | 36 months |
Disability Extension
If a qualified beneficiary is determined disabled (by Social Security) within the first 60 days of COBRA, the 18-month period can extend to 29 months. During months 19–29 the plan may charge up to 150% of the premium.
Memory hook: 18 = job-related events; 36 = family-status events; 29/150% = the disability extension.
COBRA Notice Timeline
The election process runs on a chain of deadlines. Mixing these up is a common exam error.
| Step | Responsible party | Deadline |
|---|---|---|
| Notify plan of termination/death/Medicare | Employer | 30 days from event |
| Notify plan of divorce or child losing status | Employee/beneficiary | 60 days from event |
| Send election notice | Plan administrator | 14 days after being notified |
| Elect continuation | Qualified beneficiary | 60 days from later of notice or coverage loss |
| First premium payment | Qualified beneficiary | 45 days after election |
Worked Timeline
An employee is terminated March 1. The employer notifies the plan by March 31 (30 days). The plan sends the election notice by April 14. The beneficiary has 60 days to elect and then 45 days to pay the first (retroactive) premium, so coverage never actually lapses if deadlines are met.
HIPAA: Portability and Privacy
HIPAA (Health Insurance Portability and Accountability Act) complements COBRA by protecting coverage and information.
| HIPAA protection | What it does |
|---|---|
| Portability | Limits a new plan's ability to impose pre-existing exclusions when you had prior coverage |
| Creditable coverage | Prior coverage (including COBRA) credits against any waiting/exclusion period |
| Guaranteed renewability | Group plans must renew regardless of health |
| Nondiscrimination | Cannot deny eligibility based on a health factor |
| Privacy/Security Rules | Protect Protected Health Information (PHI) |
Under the ACA, pre-existing condition exclusions are largely prohibited for medical plans, but HIPAA's portability and privacy framework remains heavily tested.
Trap: Gross misconduct terminations are NOT a COBRA qualifying event — the employer may deny continuation. Watch for fact patterns where the answer hinges on whether the termination was for misconduct.
Mastering the Numbers
COBRA questions are almost always about a specific figure, so the safest preparation is to fix the numbers in memory and understand why each exists. The 20-employee threshold defines which employers are subject to federal COBRA; smaller employers may fall under a state mini-COBRA law instead, which Oregon provides. The 102 percent premium reflects the full group cost plus a two percent administrative load, and the 150 percent charge applies only during the disability extension months.
The durations follow a clean logic worth memorizing as a pair: 18 months for employment-related events (termination for anything short of gross misconduct, or a reduction in hours) and 36 months for family-status events (divorce, death of the employee, the employee becoming Medicare-entitled, or a child aging out of dependent status).
The notice chain is the other heavily tested area, and the deadlines run in a sequence that a scenario question can scramble. The employer has 30 days to notify the plan of a termination, death, or Medicare entitlement, while the employee or beneficiary has 60 days to report a divorce or a child losing dependent status — because the employer cannot know about those family events. The plan administrator then has 14 days to send the election notice, the qualified beneficiary has 60 days to elect, and another 45 days to make the first, retroactive premium payment.
If everyone meets the deadlines, coverage never actually lapses even though the election happens after the loss date.
HIPAA's Role Today
HIPAA originally limited pre-existing-condition exclusions by crediting prior coverage, but the ACA's near-total ban on pre-existing exclusions for medical plans has largely absorbed that function. What remains heavily tested is HIPAA's portability of creditable coverage, its guaranteed renewability of group plans, its nondiscrimination rule barring eligibility decisions based on a health factor, and above all its Privacy and Security Rules protecting protected health information.
Producers handle PHI and must follow these safeguards, so expect questions distinguishing what HIPAA protects (information and portability) from what COBRA provides (temporary continuation of the coverage itself).
Exam Trap: Termination for gross misconduct is not a COBRA qualifying event, so the employer may deny continuation entirely. When a fact pattern stresses serious employee wrongdoing, the correct answer is that no COBRA right arises.
A 45-year-old employee voluntarily quits a job at a company with 300 employees. For how long, and at what maximum premium, may she continue her group health coverage under COBRA?
Following a divorce, within how many days must the employee or qualified beneficiary notify the plan administrator to preserve COBRA rights for the former spouse?