As employers face another year of significant health plan cost increases, many are taking a closer look at self-funding as a potential way to gain greater control over their health plan costs. But the financial analysis should not be the only item on the to-do list. Moving from a fully insured health plan to a self-funded arrangement can also change an employer’s responsibilities under the Health Insurance Portability and Accountability Act (HIPAA).
A group health plan is a covered entity under HIPAA. With a fully insured plan, however, the insurance carrier frequently handles many of the functions involving protected health information (PHI), which can significantly limit the HIPAA compliance responsibilities that fall on the employer. With a self-funded plan, the employer typically assumes a much more significant role in administering the plan, even when it hires a third-party administrator (TPA) to process claims. That means employers considering self-funding should add HIPAA compliance to their implementation checklist.
Here are some of the key items to consider:
- Conduct a HIPAA security risk analysis. If the plan creates, receives, maintains, or transmits electronic PHI, it should conduct a risk analysis to identify potential risks and vulnerabilities to that information. This is more than an IT exercise. It should consider where the plan's electronic PHI is located, who has access to it, how it is transmitted and stored, and what safeguards are in place. HHS describes the risk analysis as a foundational step in determining the safeguards needed to comply with the HIPAA Security Rule.
- Adopt privacy and security policies and procedures. A self-funded plan should have written policies addressing how PHI is used, disclosed, and protected. The policies should also address issues such as workforce access to PHI, individual privacy rights, security safeguards, incident response, and breach notification. Employers should also identify the individuals responsible for overseeing HIPAA privacy and security compliance and make sure employees with access to PHI receive appropriate training. These are responsibilities reflected in existing plan privacy and security materials as well.
- Review and amend the plan document. If PHI will be disclosed to the employer as plan sponsor for plan administration purposes, HIPAA requires specific protections to be incorporated into the plan documents. Among other things, the documents establish the permitted uses and disclosures of PHI and help maintain the required separation between the employer's plan-administration functions and its employment functions. The plan sponsor must also provide the required certification regarding its use and protection of PHI before receiving PHI in circumstances subject to these requirements.
- Identify business associates and put appropriate agreements in place. A self-funded plan will typically rely on outside vendors that have access to PHI, including the TPA and potentially other service providers. The plan should identify its business associates and make sure appropriate Business Associate Agreements (BAAs) are in place. HHS explains that a covered entity generally may disclose PHI to a business associate only after obtaining appropriate written assurances that the business associate will safeguard the information.
- Prepare and distribute a Notice of Privacy Practices. Participants must receive a notice explaining how the plan may use and disclose their PHI, their rights with respect to that information, and the plan's responsibilities. Employers moving to self-funding should not simply assume the insurance carrier's existing notice will continue to do the job. Your Notice is supposed to reflect your privacy policies, and the insurer’s version would have summarized the insurer’s policies. Furthermore, agreements with TPAs may expressly place responsibility for preparation, review, and distribution of the Notice of Privacy Practices on the plan.
- HIPAA training. All employees who may have access to PHI should be trained on HIPAA before first accessing PHI and then on a regular basis. It is hard for an employee to comply with HIPAA if they don’t fully understand it.
None of these requirements should discourage an employer from considering self-funding. But they do mean that the decision involves more than selecting a TPA and purchasing stop-loss coverage. Ideally, HIPAA compliance should be part of the transition process from the beginning. HR, benefits, legal, and IT teams may all need to be involved in determining what PHI the employer will receive, who will have access to it, where it will be stored, and what safeguards are necessary.
For employers considering a move to self-funding for 2027, now is a good time to identify the HIPAA work that will need to accompany that change. Addressing those requirements as part of implementation is far easier than discovering after the plan is up and running that important HIPAA policies, documents, or safeguards were never put in place. If you need assistance with HIPAA compliance or have questions on HIPAA, please reach out to any member of the Employee Benefits team.
