Nixon & Lindstrom Insurance

HIPAA PRIVACY FOR EMPLOYERS
A Comprehensive Introduction

HIPAA Privacy Regulations-General
The final HIPAA Privacy Regulation was released on December 20, 2000, revised on August 14, 2002, and will be effective for compliance on April 14, 2003. This regulation offers the first comprehensive federal protection for the privacy of individuals' health information. The Office of Civil Rights will enforce the regulation. The federal privacy regulations are considered a "floor" of privacy standards and may be superseded by more stringent state privacy regulations. The privacy regulation governs the use and disclosure of Protected Health Information (PHI). Employers who offer or conduct certain benefits or services may be required to comply.

This summary document has been written to provide employers and group health plans with a detailed overview of the privacy regulations under HIPAA and assist them in identifying potential areas of review and action. The full text of the privacy regulations can be found at http://aspe.os.dhhs.gov/admnsimp.

This document should be considered as informational only and are not meant to convey legal advice or counsel. Employers and group health plans should involve their legal counsel to advise and assist them in determining what they must do to meet their specific obligations under the HIPAA Privacy Regulation.

SECTION ONE: KEY COMPONENTS OF THE PRIVACY RULE

CONSUMER CONTROL OVER PROTECTED HEALTH INFORMATION (PHI)

LIMITATIONS OF THE USE AND RELEASE OF PHI

IMPLEMENTATION REQUIREMENTS

ACCOUNTABILITY AND ENFORCEMENT

OTHER PERMITTED DISCLOSURES

SECTION TWO: EMPLOYERS/PLAN SPONSORS AND GROUP HEALTH PLANS

WHAT DOES HIPAA PRIVACY MEAN TO GROUP HEALTH PLANS?

FULLY INSURED GROUP HEALTH PLANS

SELF-INSURED GROUP HEALTH PLANS

GROUP HEALTH PLANS AND THEIR BUSINESS ASSOCIATES

IMPACT OF HIPAA ON DISCLOSURES TO PLAN SPONSORS

SECTION THREE: EMPLOYERS AS PROVIDERS

SECTION FOUR: COMPLIANCE

SUGGESTED PLAN OF ACTION FOR COMPLIANCE (THE GROUP'S LEGAL COUNSEL SHOULD BE THOROUGHLY INVOLVED IN THIS PROCESS)

SECTION 5: HELPFUL REFERENCES

SECTION SIX: QUESTIONS ON THE NOTICE OF PRIVACY PRACTICES FOR THE USE AND DISCLOSURE OF PRIVATE HEALTH INFORMATION