What HIPAA privacy duties come with a self-funded or level-funded plan?

A self-funded or level-funded plan is not an insurance contract, so it cannot use the hands-off exemption that fully insured plans have. The plan, acting through the employer, must:

• designate a privacy official and a contact person for complaints;
• adopt written privacy policies and procedures, and train every workforce member who handles plan information;
• keep administrative, technical and physical safeguards, a complaint process, sanctions for staff who break the rules, and mitigation of harm;
• apply the minimum-necessary standard to uses and disclosures;
• maintain and distribute its own notice of privacy practices;
• sign business associate agreements with the TPA, PBM, stop-loss or COBRA vendors and anyone else handling its PHI;
• amend the plan document and obtain the employer’s certification before any PHI goes to the employer;
• keep required documentation for six years from creation or the date last in effect, whichever is later.

The HIPAA Security Rule also applies to electronic PHI. Small size does not help: a TPA-administered plan is covered however few people it has.

Sources