HIPAA Training for Employers

2026 Edition

Audio
Presented by: Brian Gilmore | Lead Benefits Counsel, VP

Guide Topics

HIPAA Training for Employers

From Portability to Privacy and Security

• HIPAA = The Health Insurance Portability and Accountability Act of 1996 (HIPAA)
• Two main branches of HIPAA compliance—Portability and Privacy (most trainings cover only Privacy)
• This session will cover both aspects of HIPAA, with a focus on the Privacy training component
• HIPAA imposes the only mandatory employee benefits-related training requirements for employers with self-insured plans
• Use this session to satisfy and document your training requirement if you are within the HIPAA firewall!

Discussion

HIPAA Portability and Privacy Topics for

• Portability: HIPAA special enrollment events, ACA eliminates certificates of creditable coverage
• Nondiscrimination: HIPAA and ACA’s extensive structure of rules to regulate wellness programs
• Covered Entities: All employer-sponsored group health plans are HIPAA covered entities
• PHI: What qualifies as Protected Health Information, the big exception for enrollment data, and case studies of enforcement
• Compliance Strategies: How to avoid a HIPAA breach and satisfy documentation requirements

Don’t Forget:

Document

Training

Template employee HIPAA training sign-in sheet
Click here for a fillable pdf employee sign in sheet you can use!

!

Click here https://go.newfront.com/hubfs/PDFs/Newfront%20HIPAA%20Training%20Sign%20In%20Sheet.pdf for a fillable pdf employee

HIPAA – The Big Picture

The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”)
HIPAA includes two main areas for employers.

HIPAA Portability

01

Pre-ACA Requirements

Certificates of Creditable Coverage

ACA PCE Prohibition

Ended HIPAA Certificates of Creditable Coverage

As of December 31, 2014, health plans are no longer required to provide a HIPAA certificate of creditable coverage upon the loss of coverage.

• Reason is that ACA now prohibits health plans from imposing any pre-existing condition exclusions
• Therefore, individuals will no longer need to provide evidence that they have maintained creditable coverage to avoid pre-existing condition exclusions

There is no uniform type of documentation plans rely on to substantiate a mid-year HIPAA special enrollment event based on loss of other coverage.

• In the past, plans and carriers typically relied on the HIPAA certificate of creditable coverage as evidence of the mid-year loss of coverage
• Best alternative is the employer providing a letter on its letterhead stating when coverage under the plan terminated (but this should no longer be a HIPAA certificate with obsolete rights listed)

Other possible alternatives (from the old pre-2015 regulations, but still useful) include:

• EOBs or other correspondence from plan or issuer indicating coverage
• Pay stubs showing payroll deductions for health coverage
• Third-party statements verifying periods of coverage (e.g., from employer)
• Phone call from plan or provider to third-party verifying coverage
• Health ID cards
• Records from medical providers indicating coverage

Life After

HIPAA

Certificates

Documenting Prior Coverage

Preferred alternative to the obsolete HIPAA certificate of creditable coverage to substantiate a mid-year HIPAA special enrollment event based on loss of other coverage.

!

02

Special Enrollment Events

Mid-Year Health Plan Enrollment Rights

HIPAA Special

Enrollment Events

Which Events Qualify?

The following events qualify as HIPAA special enrollment events:

• Loss of eligibility for other group health coverage or individual insurance coverage
• Loss of Medicaid/CHIP eligibility or becoming eligible for a state premium assistance subsidy under Medicaid/CHIP
• Acquisition of a new spouse or dependent by marriage, birth, adoption, or placement for adoption

The medical plan must permit employees to make election changes as required by HIPAA

• Other Section 125 permitted election change events are optional for employer and carrier/stop-loss to recognize
• The medical plan and insurance carrier/stop-loss must accommodate all HIPAA special enrollment events

Right to Change Medical Plan Options

• Upon experiencing a HIPAA special enrollment event, the plan is required to allow the employee to select any medical benefit package under the plan
• For example, move from Kaiser to UHC, Cigna to Kaiser, HMO Low to PPO High, etc.

General 30-Day Election Period

• Employees must have a period of at least 30 days from the date of the event to enroll or change their election pursuant to a HIPAA special enrollment event

Medicaid/CHIP: Special 60-Day Election Period

• Longer periods would need to be approved by the insurance carrier or stop-loss provider
• When employees lose Medicaid/CHIP eligibility, or where they gain eligibility for a state premium assistance subsidy under Medicaid/CHIP, they must have at least 60 days from the date of the event to enroll or change their election
• This is a good ERISA trivial pursuit question

HIPAA Special Enrollment Events

Effective Date: Generally First of the Month Following Election

• The general rule is that an election to enroll in coverage pursuant to a HIPAA special enrollment event must be effective no later than the first of the month following the date of the timely submitted election change request
• Example 1: Jack marries Jill on April 19, and he submits the election change request to enroll Jill on April 22. Jill’s coverage should be effective no later than May 1.
• Example 2: Jack marries Jill on April 19, but does not submit the election change request to enroll Jill until May 14. Jill’s coverage should be effective no later than June 1.

Birth/Adoption: Coverage Retroactive to the Date of the Event

• Where an employee has a new child through birth, adoption, or placement for adoption, coverage for the new child must be effective as of the date of the event
• Example: Jack’s spouse Jill gives birth to a child on July 19. Jack submits the election change to enroll the child on August 14. The child’s coverage must be effective as of July 19 (the date of birth)

Existing Dependents: No Special Enrollment Rights

• Upon birth, the HIPAA rules limit the special enrollment rights to the employee, the spouse, and any newly acquired dependents (i.e., the newborn child)
• Any other dependents (e.g., siblings of the newborn child) are not entitled to special enrollment rights upon the employee’s acquisition of the new dependent through birth
• The exclusion of existing dependents from special enrollment rights prevents the employee from having the right to add an existing child to the plan upon the birth of the new child (optional cafeteria plan “tag-along” rule may permit enrollment)

HIPAA Special Enrollment Events

A Subset of Section 125 Events

Section 125 Cafeteria Plan Permitted Election Change Event Chart

Click here for a summary overview of the permitted election change events!

!

03

Health Status Nondiscrimination

Wellness Programs

Wellness Program HIPAA/ACA History

1996 2006 2010 2013

Federal Laws That May Apply to Wellness Programs

1. HIPAA Nondiscrimination (as modified by the ACA)
2. ADA
3. GINA
4. ACA Market Reforms
5. ERISA
6. COBRA
7. HIPAA Privacy/Security
8. More? (ADEA, FLSA, IRC)

Which Wellness Programs Must Comply?

The threshold issue for a wellness programs is to determine if it must comply with the HIPAA/ACA and the ADA requirements.

HIPAA/ACA Threshold Question

Is the wellness program a group health plan?

• An employee welfare benefit plan is a group health plan if it provides “medical care”
• “Medical care” generally refers to “the diagnosis, cure, mitigation, treatment, or prevention of disease, or amounts paid for the purpose of affecting any structure or function of the body”
• Most wellness programs will fall into this category of group health plan
• Any form of blood draws, screening, examinations, assessments, disease management, health incentives, or counseling by trained professionals likely triggers group health plan status
• Pure referral services, general information for mere promotion of good health, or basic educational sessions not customized to the employee likely are not a group health plan

ADA Threshold Question

Does the wellness program include:

1. Disability-related inquiries; and/or
2. Medical Examinations

• The ADA rules apply to any wellness program that is an “employee health program” that asks employees to respond to disability-related inquiries and/or undergo medical examinations
• Includes wellness programs that are offered only to employees enrolled in the employer-sponsored group health plan, offered to all employees regardless of whether they enrolled in the employer’s plan, or offered by employers that do not offer a group health plan
• Examples of “employee health programs” that may trigger the ADA regulations include health risk assessments (HRAs) to determine risk factors, medical screening for high blood pressure/cholesterol/glucose, classes to help employees stop smoking or lose weight, physical activities (e.g., walking or daily exercise), coaching to help employees meet health goals, and/or flu shots

Two Main Types of Wellness Programs

From the HIPAA Nondiscrimination Rules

Participatory Programs

• If none of the conditions for obtaining a reward under a wellness program is based on an individual satisfying a standard that is related to a health factor (or if a wellness program does not provide a reward), the wellness program is a participatory wellness program.

Health-Contingent Programs

• A health-contingent wellness program is a program that requires an individual to satisfy a standard related to a health factor to obtain a reward (or requires an individual to undertake more than a similarly situated individual based on a health factor in order to obtain the same reward). **A health-contingent wellness program may be an activity-only wellness program or an outcome-based wellness program.

!

Two Main Types of Wellness Programs

Which Requirements Apply—HIPAA and ADA Overview

1. Participatory Programs

1. Program must be available to all similarly situated individuals
2. Program must be voluntary*
3. Program must provide reasonable accommodations*
4. Program must be reasonably designed to promote health or prevent disease*
5. Program reward/incentive is generally limited to 30% of the cost of coverage*
6. ADA wellness program notice provided to employees

2. Health-Contingent Programs

All six of the participatory program requirements, plus three more:

7. Program must offer individuals the opportunity to qualify for rewards at least once per year
8. Program must provide reasonable alternative standards (or waiver of standards) to obtain reward in certain situations
   • Significantly different rules apply for activity-only vs. outcome-based programs
9. HIPAA nondiscrimination wellness program notice describing reasonable alternative standards included in all plan materials describing the health-contingent wellness program

Important note: A federal court ruled in AARP v. EEOC that incentive components of the 2016 EEOC wellness program rules do not meet the requirements of the ADA, and that the EEOC must issue new regulations meeting certain standards. The EEOC accordingly formally removed those aspects of the regulations.

The EEOC issued new proposed regulations in January 2021 at the very end of the Trump administration that would have significantly changed the 2016 rules, however the Biden administration withdrew them shortly thereafter pursuant to a freeze on Trump regulations.

We feel that the best practice approach is to continue following the vacated 2016 EEOC regulations until we have new guidance specifying the ADA requirements moving forward. Regardless, the HIPAA nondiscrimination rules for wellness programs do remain in effect.

HIPAA Privacy/Security

Overview

Key Terms and Primary Responsibilities

HIPAA Privacy 101: Key Terms

Covered Entity

• Health Plan
  • Employer-sponsored group health plans
  • Health insurance carriers (including HMOs)
  • Medicare, Medicaid, VA, IHS, TRICARE, etc.
• Health Care Clearinghouse
• Health Care Provider (who transmits health information electronically)
  • Doctors, nurses, hospitals, clinics, psychologists, dentists, chiropractors, nursing homes, pharmacies, etc.

Business Associate

• An entity that performs a listed function or activity on behalf of a covered entity; and
• Creates, receives, maintains, or transmits PHI on behalf of the covered entity
• Examples: Claims processing, data analysis, utilization review, billing, legal, actuarial, accounting, consulting, data aggregation

Protected Health Information (PHI)

• Individually identifiable health information maintained or transmitted by a Covered Entity or Business Associate
• Excludes enrollment/disenrollment information used by the employer for employment purposes (that does not include any substantial clinical information)

HIPAA PHI

Individually identifiable health information maintained or transmitted by a Covered Entity or Business Associate

• An e-mail sent to an insurance carrier or Third-Party Administrator about an employee's claim that includes the health condition and an identifier
• A hard copy or electronic copy of an Explanation of Benefits
• A claims experience report kept in electronic format or hard copy that contains identifiers
• A transition of care form
• Health Risk Assessments
• Enrollment/disenrollment information maintained by a covered entity/business associate (i.e., not maintained by the employer as an employment record) | - Employment/HR records with data not collected from a covered entity, including information to comply with other laws
• Such as information collected for FMLA, sick leave, or other similar leaves; alcohol and drug-free workplace law compliance; information required by Americans with Disabilities Act; fitness for duty reports
• Health information from non-health care plans
• Such as STD/LTD; life insurance; AD&D; business travel accident; workers' compensation
• General health care information
• Information that is not individually identifiable or did not come from a HIPAA covered entity/business associate |

The BIG Exception– Enrollment/Disenrollment Information

The exclusion of enrollment/disenrollment information from the definition of PHI subject to all the HIPAA protection significantly limits the scenarios where HIPAA applies.

Enrollment Information: PHI?

• Employment records held by the covered entity in its role as employer are not PHI
• This exclusion from PHI applies to enrollment and disenrollment information held by the employer
• Such information cannot include any substantial clinical information to qualify for the PHI exemption
• Significantly limits which and how often employers actually use or disclose PHI
• Enrollment and disenrollment information held by a covered entity (or business associate) other than the employer is PHI if created by or received from a covered entity (i.e., not from the employer in its role as employer)
• Such entities are not the employer and therefore do not hold such information as employer records

The BIG Exception– Enrollment/Disenrollment Information

Relevant Cites

45 C.F.R. §160.103

• (2) Protected health information excludes individually identifiable health information: (iii) In employment records held by a covered entity in its role as employer

65 Fed. Reg. 82461, 82496
"Plan sponsors that perform enrollment functions are doing so on behalf of the participants and beneficiaries of the group health plan and not on behalf of the group health plan itself. For purposes of this rule, plan sponsors are not subject to the requirements of § 164.504 regarding group health plans when conducting enrollment activities."

67 Fed. Reg. 53181, 53208
"[T]he standard enrollment and disenrollment transaction does not include any substantial clinical information…However, the Department clarifies that, in disclosing or maintaining information about an individual’s enrollment in, or disenrollment from, a health insurer or HMO offered by the group health plan, the group health plan may not include medical information about the individual above and beyond that which is required or situationally required by the standard transaction and still qualify for the exceptions for enrollment and disenrollment information allowed under the Rule."

Questions

What was the
original purpose
of the Health
Insurance
Portability and
Accountability
Act (HIPAA)?

!

Does HIPAA
prohibit the use
or disclosure of
an individual’s
protected health
information
(PHI)?

!

Does HIPAA
prohibit me from
listening to
someone tell me
about their
medical
problem?

!

While doing my
job, can I be held
civilly and/or
criminally
responsible for a
HIPAA violation?

!

HIPAA Privacy and Security

Why Should Plan Sponsors Care?

• Any employer that provides group health benefits is affected based on the level of exposure to PHI
• Employers with self-insured plans effectively are directly subject to the rules
• Even fully insured plans need to be sensitive to HIPAA
• Company access to employee health plan records for employment reasons (including administration of benefit plans) is severely limited
• Civil and criminal actions may be brought by HHS
• If HHS fails to act, state attorney generals may bring civil suits
• Civil monetary penalties (indexed) can be assessed by HHS, and were significantly increased by HITECH

• Based on 2019 HHS enforcement policy that sets penalty caps below current indexed levels.

HHS Posts Resolution

Agreements and Civil Monetary

Payments

https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/index.html

HIPAA Civil Liability Case Study #1

Medical Center’s Unencrypted Laptop and Flash Drive

$3 Million HIPAA Settlement Agreement

• University Medical Center paid $3 million in November 2019 to the HHS OCR for two major breaches (2013 and 2017)
• Unencrypted flash drive containing unsecured PHI lost in 2013
• Unencrypted laptop of surgeon containing unsecured PHI stolen in 2017
• Severity in part because the Medical Center “failed to implement sufficient mechanisms to encrypt and decrypt ePHI”
• Also failed to implement security measures sufficient to reduce risks and vulnerabilities despite similar 2010 breach also involving a lost unencrypted flash drive and assistance from HHS OCR to improve policies

Bottom Line: Don’t store unencrypted PHI on portable devices!

• HHS OCR: “Because theft and loss are constant threats, failing to encrypt mobile devices needlessly puts patient health information at risk…When covered entities are warned of their deficiencies, but fail to fix the problem, they will be held fully responsible for their neglect.”
• Full details: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/urmc/index.html

HIPAA Civil Liability Case Study #2

Dentist Discloses PHI of Patient on Social Media

$50,000 Civil Monetary Penalty

• Dental patient posted a negative review (using a pseudonym) of a North Carolina dentist in 2015 on the dentist’s Google page
• The dentist responded on the public google review site
• Dentist’s response impermissibly disclosed the patient’s name and PHI
• Dentist did not respond to OCR’s data request or subpoena, then waived rights to a heaving by not contesting the OCR findings

Bottom Line: Don’t disclose PHI on public websites or social media!

• HHS OCR: “Here, UPI impermissibly disclosed the PHI of one individual, revealing his name, medical history, and the nature of his medical treatment. Despite repeated notice of this impermissible disclosure, UPI has not demonstrated any effort to mitigate any potential harmful effects of the impermissible disclosure or to come into compliance with the applicable provisions of the Privacy Rule by removing the PHI from its Google page.”
• Full details: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/upi/index.html

HIPAA Civil Liability Case Study #3

Unauthorized Disclosure to Media of Photography of Patients Suffering from Covid

$80,000 HIPAA Settlement Agreement

• Saint Joseph’s Medical Center shared photographs and other information to the Associated Press related to Covid
• AP Exclusive: ‘It’s been a nightmare’ for Yonkers ER doc
• ‘I needed to Tell Their Story’ AP Staffer Captures ER Save
• Disclosure of three patients photographed was without their authorization
• HIPAA covered entities cannot disclose PHI to the media without first obtaining written authorization, even when reporters on site
• Medical Center paid $80,000 to OCR and agreed to implement a corrective action plan to comply with HIPAA going forward

Why Are the AP Materials Still Publicly Available?

• The media is not a HIPAA covered entity—it’s the responsibility of covered entities (and their business associates) to use or disclose PHI only as permitted or required by HIPAA
• AP takes the position that the photos are important to tell frontline pandemic story to public—difficult moral questions here
• Full details: https://www.hhs.gov/about/news/2023/11/20/hhs-office-civil-rights-settles-hipaa-investigation-st-josephs-medicalcenter-disclosure-patients-protected-health-information-news-reporter.html

HIPAA Civil Liability Case Study #4

Ransomware Attack at Business Associate from Phishing Email

$240,000 Civil Monetary Penalty

• Physician group (covered entity) with 35 medical offices engaged with IT vendor for data management services (business associate)
• The physician group failed to enter into a business associate agreement (BAA) with the IT vendor
• Employee at one of the physician group divisions clicked on a phishing email, allowing hackers to gain remote access to PHI
• Resulted in three waves of ransomware attacks that compromised the PHI of 85,000 individuals
• The compromised PHI included names, addresses, dates of birth, driver’s license numbers, Social Security numbers, lab results, medications, treatment information, credit card information, bank account numbers, and other financial information.

Bottom Line: Ensure BAAs are in place with business associates (outside vendors that have access to PHI)

• HHS OCR: “While OCR acknowledges that PMI took some corrective actions to resolve the potential noncompliance during OCR’s investigation, PMI/COS failed to have a Business Associate Agreement in place with its IT vendor for many years and its access control deficiencies contributed to the ransomware attacks.”
• Full details: https://www.hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements/pmi-nfd/index.html

HIPAA Civil Liability Case Study #5

Reproductive Health Disclosure Without Authorization

$35,581 HIPAA Settlement Agreement

• Medical practice in Pennsylvania received an authorization from a patient to release one specific test result to prospective employer
• The medical practice erroneously provided the prospective employer with the patient’s entire medical record
• Included surgical history, genealogical history, obstetric history, and other sensitive PHI concerning reproductive health care
• The medical practice did not have the patient’s authorization for the broad disclosure of her PHI, and there otherwise was no applicable permission under HIPAA for such a broad release of her medical records
• On top of the settlement payment, the group agreed to a multi-step Corrective Action Plan to be monitored by HHS OCR for the next two years to ensure this type of breach never occurs again

Bottom Line: Do not disclose PHI beyond the specific information set forth in an authorization—especially sensitive PHI

• HHS OCR: “Patients must be able to trust that sensitive, health information in their files is protected to preserve their trust in the patient-doctor relationship and ensure they get the care they need. This is particularly true for reproductive health privacy.”
• Full details: https://www.hhs.gov/about/news/2024/11/26/hhs-office-civil-rights-settles-holy-redeemer-hospital-disclosure-patients-protected-health-information-including-reproductive-health-information.html

HIPAA Privacy and Security

Why Should Plan Sponsors Care?

Potential Criminal Penalties

• Covered entities, business associates, and their employees can be held criminally liable for knowingly violating HIPAA
• These criminal penalties apply only where there is criminal intent
• Inadvertent mistakes with respect to HIPAA are not the concern here
• HIPAA prosecutions occur for situations like identity theft, selling celebrity medical information to the media, Medicare fraud, accessing PHI of individuals the medical practitioner is not treating, etc.

02

HIPAA Privacy

HIPAA Privacy Overview

Patients Have the Right to Understand and Control How Their Health Information Is Being Used

• Notice of Privacy Practices: Providers and health plans to give individuals clear, written notice of how they use, keep, and disclose their health information
• Individuals have right to access their medical records (to view, make copies, request amendments, and obtain accounting for non-routine disclosures)
• Individual authorizations required before information is released in most non-routine situations
• Covered entities accountable for use and release of information, with recourse available if privacy is violated

Use of Individual Health Information Generally Limited to Health Purposes

• PHI generally cannot be used for purposes other than “treatment,” “payment,” or “health care operations” without individual authorization
• Individual authorizations must be informed and voluntary
• Most insurance carriers require use of HIPAA authorizations prior to disclosing PHI with respect to a participant enrolled in an insured group health plan
• Minimum Necessary Rule: Reasonable efforts must be undertaken to limit release of information to minimum necessary amount
• Minimum necessary amount requirement applies to use of protected health information for payment or health plan operations, but not for treatment purposes

The Big

Three

Permitted

Uses of PHI

HIPAA permits covered entities to use or disclose PHI for three different reasons without requiring the individual’s authorization. These three items are disclosed in the covered entity’s notice of privacy practices and permit the health care industry to function smoothly.

• Providing of care by health care providers
  Treatment

• Does not apply to health plan covered entities (including employers)

• Remember that the minimum necessary rule does not apply to treatment

• To obtain premiums, determine or fulfill responsibility for coverage and provision for benefits under the health plan, to provide reimbursement
  Payment

• Includes eligibility determinations, subrogation, risk adjusting, billing, claims management, collection, stop-loss, medical necessity and utilization review

• Quality assessment and improvement, patient safety activities, case management, care coordination, information about treatment alternatives
  Health Care Operations

• Underwriting, enrollment, premium rating, and other contractual processes, customer service, plan sponsor data analysis, wellness program operations

HIPAA

Privacy

Overview

Key Points to Remember

Minimum privacy safeguard standards established for covered entities (with similar requirements applicable to business associates and, in some situations, even plan sponsors).

• Adoption of privacy procedures, with safeguards and sanctions specified
• Periodic distribution of privacy notice
• Designation of a privacy officer
• Training of employees on handling PHI
• Establishment of a grievance / complaint procedure
• Recordkeeping with respect to PHI disclosures

HIPAA Privacy Overview

Fully Insured Plans: Reduced Compliance Burden

• With fully insured plans, both the group health plan and the insurance carrier are HIPAA covered entities
• Generally, employers sponsoring a fully insured plan do not need HIPAA policies and procedures documents, to provide employees with a notice of privacy practices, to engage in business associate agreements, or undergo HIPAA training
• The insurance carrier is directly responsible for those requirements
• Applies where employers receive only summary health information for limited purposes and enrollment/disenrollment information
• Most employers offer a health FSA, which is a self-insured group health plan that technically is directly subject to these HIPAA requirements
• From a practical perspective, it is common for employers not to take all of the HIPAA steps described above (other than entering into a BAA with the TPA for the health FSA) where the only self-insured group health plan is the health FSA—although no technical exemption exists
• Employers with a self-insured medical plan clearly do not enjoy this exemption from documentation, disclosure, and training requirements

When is

Training

Required?

HIPAA is the only required employee benefits training! But there are a number of restrictive qualifications that significantly limit which employees actually need the training.

Only Employers With Self-Insured Health Plan

• Employers with fully insured plans are not required to train employees
• Training not required because such employers receive only summary health information for limited purposes and enrollment/disenrollment information

Only Employees Within the HIPAA Firewall

• Only those employees with a plan-related need to access PHI for plan administrative functions are within the HIPAA firewall
• These are the only employees who have access to PHI—and therefore the only employees who need training in how to handle PHI
• Generally required only for benefits and HR professionals
• Finance, accounting, payroll, C-suite, etc. generally do not need training (because they access only enrollment/disenrollment information that is not PHI as employment records)

Only New Hires & Upon a Material Change in Policies and Procedures

• Training required within a “reasonable period of time” after hire
• After the initial training, re-training required only upon a material change in the plan’s HIPAA privacy policies and procedures
• Best practice: Retrain once every two years regardless of changes

Working with Vendors (Business Associates)

When is a BAA Required for Self-Insured Plans?

• HIPAA business associates can include third-parties in many different areas that create, receive, maintain, or transmit Personal Health Information
• Examples include (but are not limited to):
• Claims processing or administration, data analysis, legal, actuarial, accounting, consulting, data aggregation, administrative, financial services
• Employers cannot permit such third-party vendors (business associates) to access PHI under their self-insured plan without entering into a business associate agreement (BAA) on behalf of the health plan (the HIPAA covered entity)
• Fully insured plans generally do not need HIPAA BAAs
• Note that enrollment/disenrollment information maintained by the employer (that does not include any substantive clinical information) is not PHI
• BAA will impose certain required safeguards on the business associates related to HIPAA privacy and security compliance
• Note that the HITECH Act also imposes direct HHS liability on business associates—regardless of the terms of the BAA

Disclosing PHI to Family Members

General rule is that the individual must authorize disclosure of PHI that is not to a covered entity or business associate for treatment, payment, or health care operations.

In some limited situations, the covered entity (e.g., the health plan) may disclose PHI to a family member or close personal friend if the PHI is directly relevant to their involvement to assist in the individual’s care or payment.

Individual Has Capacity to Make Health Care Decision

Covered entity may disclose if:

• Obtains agreement (written or oral) from the individual;
• Provides the individual with the opportunity to object to the disclosure (and the individual does not object); OR
• Reasonably infers from the circumstances, based on exercise of professional judgment, that the individual does not object to the disclosure

Individual Not Present, Incapacitated, or Emergency

Covered entity may disclose if:

• In the exercise of professional judgment determines that the disclosure is in the best interests of the individual; AND
• Limits disclosure to only the PHI that is directly relevant to the person’s involvement with the individual’s care or payment related to the individual’s health care or needed for notification purposes

Disclosing PHI to Family Members

https://www.hhs.gov/hipaa/for-professionals/faq/1067/may-a-health-plan-disclose-information-to-a-person-who-calls/index.html

03

HIPAA Security

HIPAA Security Overview

Key points to remember

Establishes three primary standards (administrative safeguards, physical safeguards, and technical safeguards) with various required or addressable implementation specifications

!

• Reflects commonly accepted IT security safeguards widely used across many industries
• Security measures to be tailored to organization’s risk analyses, technical environment, and business needs
• Must be flexible and dynamic, while being reasonable and scalable
• High premium on documentation of decision process and implementation of risk assessment and appropriate countermeasures

HIPAA Workforce Members

The HIPAA Firewall

• HIPAA firewall should ensure that only those employees with a plan-related need to access PHI for plan administrative functions are permitted access to the plan’s PHI
• Plan administration functions include payment and health care operations activities performed by employees of the employer
• Does not include employee enrollment and disenrollment information maintained by the employer (that does not include substantial clinical information) because such information is not PHI protected by HIPAA

HIPAA Workforce Members

The HIPAA Firewall

Open Workspaces & Hotel Seating vs. The HIPAA Firewall

Benefits professionals should be careful to limit their conversations and documents that include PHI to private offices, conference rooms, call rooms, or other private areas that are available on-demand

• Keep in mind that employee enrollment and disenrollment information maintained by the employer (that does not include substantial clinical information) is not PHI protected by HIPAA
• This should limit the frequency in which PHI will be viewed or discussed by employees within the firewall whose job duties are related to the plan

Avoiding PHI Issues: De-Identification

De-identified information is not PHI

• De-identified health information cannot be used to identify an individual
• Can be no reasonable basis to believe that the information can be used to identify the individual
• Must remove 18 specific identifiers for the information to be “de-identified” and non-PHI that is not subject to these HIPAA restrictions

De-Identified HIPAA PHI

De-Identified Information Must Remove 18 Identifiers from PHI

1. Names
2. Geographic divisions smaller than a State:
   • Address, city, county, precinct, zip code, geocode
   • Initial three digits of zip code may be included with restrictions
3. All dates more precise than the year:
   • Date of birth/death, admission/discharge date, all ages over 89
4. Phone numbers
5. Email addresses
6. SSNs
7. Medical record numbers
8. Health plan beneficiary numbers
9. Account numbers
10. Certificate/license numbers
11. Vehicle identifiers:

• Serial/license plate numbers

12. Device identifiers and serial numbers
13. URLs
14. IP address numbers
15. Biometric identifiers:

• Fingerprints, voice prints

16. Full face pictures and anything comparable
17. Any other unique identifying number, characteristic, or code

New DOL Guidance on Cybersecurity

Full Details:
Compliance Assistance Release No. 2024-01

• The DOL put out cybersecurity guidance in 2021 that was widely regarded as directed toward retirement plans.
• In 2024, the DOL clarified that employers have the same fiduciary responsibility to include cybersecurity matters as part of the process to prudently select and monitor vendors for non-retirement plan benefits.

04

Compliance Strategies

Compliance Strategies

Review of Basic Standards to Follow in Day-to-Day Practice

• PHI and e-PHI must remain confidential and may only be used for the purpose it was made available to you
• Do not share PHI and e-PHI with unauthorized individuals (even including co-workers who have no plan-related need to know)
• Do not share or discuss PHI or e-PHI with a friend or spouse
• Use physical safeguards to protect PHI and e-PHI (e.g., locking all files that contain PHI; “clean desk” policies; using only assigned and secure fax machines; not taking PHI or e-PHI home in files or on flash drives or laptops)
• Use electronic safeguards to protect e-PHI (e.g., only store e-PHI on network drives that are frequently backed up and subject to electronic protection; encrypt non-network stored e-PHI)
• In transmitting e-PHI by e-mail, use encryption
• Identify and limit, to the extent possible, transmission of e-PHI through potentially unsecured medium (such as computers, PDAs, flash drives, servers, and other electronic devices)
• If you receive an e-mail containing PHI that is not adequately protected, then follow these steps:
  • Notify the person who sent the e-mail message that e-PHI was not adequately protected, that you will be deleting his/her e-mail message, and that e-PHI should be re-sent to you through a secure medium
  • If person sends e-PHI multiple times without adequate protection, then your HIPAA privacy policy will likely require filing a report with your Privacy Official

HIPAA and Part 2: Substance Use Disorder Protections

Court Case Removes Reproductive Health Rules

However, the Substance Use Disorder Provisions Remain in Effect

Purl v. United States HHS, No. 2:24-CV-228-Z, 2025 U.S. Dist. (N.D. Tex. June 18, 2025) https://s3.documentcloud.org/documents/25979740/purl-v-hhs-opinion.pdf

The court decision vacated the portion of the rules related to reproductive health, but severed that portion and preserved the other piece related to the Part 2 Rule for substance use disorder protections:

The Part 2 Rule: Substance Use Disorder Protections

Notice of Privacy Practices Update Required

What is the Part 2 Rule?

• Protects the records of the identity, diagnosis, prognosis, or treatment of any patient in connection with any federal program or activity relating to substance use disorder (SUD)
• Includes education, prevention, training, treatment, rehabilitation, or research
• Designed to address concerns that discrimination and fear of prosecution might deter treatment for SUD

What’s New With Part 2?

• The CARES Act required the Part 2 rules to be more aligned with the HIPAA rules
• Final Part 2 rules issued February 8, 2024 completed that alignment
• Authority to enforce Part 2 rules was formally delegated to HHS OCR as of August 27, 2025
• Was initially in combination with reproductive health rules, but a court vacated the reproductive health components

The Action Item

Notice of Privacy Practices (NPP) Update by 2/16/26

• Originally the new Part 2 rules were largely addressed with the reproductive health rules that required a new attestation and NPP updates
• After the court decision, only the Part 2 SUD piece remains
• Requires NPP update by February 16, 2026 to reflect new SUD rights (but no longer includes reproductive health)

HIPAA – HITECH Act

Expanded various HIPAA privacy and security provisions

• (e.g., extended certain HIPAA obligations directly to business associates, implemented certain breach notification rules, increased penalties)

• Enactment of the Health Information Technology for Economic and Clinical Health (HITECH) Act has generated renewed interest in HIPAA privacy and security compliance.

• Staggered effective dates for various aspects of HITECH, but most become effective as of 2/17/10

• Was incorporated into the American Recovery and Reinvestment Act (ARRA or “the stimulus bill”), which was enacted within the first month of President Obama taking office (2/17/09)

What is a Breach?

“Breach” Means

• Acquisition, access, or use, or disclosure of unsecured PHI in a manner not permitted, which compromises the security or privacy of the protected health information
• An impermissible use or disclosure is presumed to be a breach unless the covered entity or business associate demonstrates that there is a low probability that the protected health information has been compromised

“Breach” Excludes

• Unintentional acquisition, access, or use of PHI by person acting under authority of group health plan or business associate
• Inadvertent disclosure by a person authorized to access PHI to another person authorized to access PHI
• Disclosure of PHI where a group health plan or business associate has a good faith belief that an unauthorized person to whom the disclosure was made would not reasonably have been able to retain the PHI

Breach Notification

Whenever a health plan discovers a breach of unsecured PHI, HITECH now requires notification to certain persons without unreasonable delay (and in no event later than 60 calendar days after discovery of breach).

Notice to Affected Individuals

• In writing by first-class mail (or by email, if individual has agreed)
• By conspicuous posting on website (called “substitute notice”), if contact information is insufficient or out-of-date
• In urgent situations (i.e., possible imminent misuse of unsecured PHI), by telephone or other appropriate means

Content of Notice to Affected Individuals

1. A brief description of what happened, including the date of the breach and the date of the discovery of the breach, if known;
2. A description of the types of unsecured PHI that were involved in the breach (such as whether full name, SSN, DOB, home address, account number, diagnosis, disability code, or other types of information were involved);
3. Any steps the individuals should take to protect themselves from potential harm resulting from the breach;
4. A brief description of what the covered entity involved is doing to investigate the breach, to mitigate harm to individuals, and to protect against further breaches; and
5. Contact procedures for individuals to ask questions or learn additional information, including toll-free phone number, email address, website, or postal address

Breach Notification

Notice to Media

• For breach involving 500 or more individuals, notify “prominent media outlets” serving the state or jurisdiction
• Without unreasonable delay (and in no event later than 60 calendar days after discovery of the breach)

Notice to U.S. Department of Health and Human Services (HHS)

• For breach involving 500 or more individuals, notify HHS as specified on HHS website
• Without unreasonable delay (and in no event later than 60 calendar days after discovery of the breach)
• For breach involving less than 500 individuals, maintain a log and provide notice to HHS within 60 days after each calendar year

Annual Report to Congress on HIPAA Breaches (Most Recent: 2022 Calendar Year)

https://www.hhs.gov/hipaa/for-professionals/breach-notification/reports-congress/index.html

HIPAA

Quick Employer Checklist for Self-Insured Plans

HIPAA Self-Insured Checklist

Don’t Forget:

Document

Training

Template Employee HIPAA Training Sign-in Sheet
Click here for a fillable pdf employee sign in sheet you can use!

!

Click here https://go.newfront.com/hubfs/PDFs/Newfront%20HIPAA%20Training%20Sign%20In%20Sheet.pdf for a fillable pdf employee

WRAP-UP

Takeaways

HIPAA Training for Employers – From Portability to Privacy THREE KEY POINTS TO REMEMBER

• HIPAA includes two major branches: Portability and Privacy. Although some features are now obsolete, the HIPAA portability rules remain relevant and important today with respect to special enrollment events and nondiscrimination based on health status for wellness programs.
• The HIPAA privacy and security rules are important for employers, especially employers with self-insured group health plans. These employers should designate a privacy official, create policies and procedures, distribute a notice of privacy practices (updated by Feb. 2026), and enter into BAAs with business associates. Employers should also be familiar with the HITECH Act breach rules.
• Employees who are within the HIPAA firewall of a self-insured group health plans are required to undergo HIPAA training within a reasonable time after joining the workforce and within a reasonable time after any material change in policies and procedures. Don’t forget to document that the training has been completed to comply with the HIPAA requirement to maintain documentation of training.

Content Disclaimer

HIPAA Training for Employers

The intent of this analysis is to provide the recipient with general information regarding the status of, and/or potential concerns related to, the recipient’s current employee benefits issues. This analysis does not necessarily fully address the recipient’s specific issue, and it should not be construed as, nor is it intended to provide, legal advice. Furthermore, this message does not establish an attorney-client relationship. Questions regarding specific issues should be addressed to the person(s) who provides legal advice to the recipient regarding employee benefits issues (e.g., the recipient’s general counsel or an attorney hired by the recipient who specializes in employee benefits law).

Newfront makes no warranty, express or implied, that adherence to, or compliance with any recommendations, best practices, checklists, or guidelines will result in a particular outcome. The presenters do not warrant that the information in this document constitutes a complete list of each and every item or procedure related to the topics or issues referenced herein. Federal, state or local laws, regulations, standards or codes may change from time to time and the reader should always refer to the most current requirements and consult with their legal and HR advisors for review of any proposed policies or programs.

Thank you

Brian Gilmore
Lead Benefits Counsel, VP
brian.gilmore@newfront.com