Short answer: Yes, in most cases. A health FSA or HRA is a group health plan, so it is a HIPAA covered entity if it has 50 or more participants or is administered by a TPA, which most are.
Health FSAs and HRAs provide medical care, so they are group health plans. The only way out is the small self-administered exception: fewer than 50 participants and run by the employer itself.
Because these plans are self-insured, the hands-off exemption for fully insured plans does not apply. If the plan is covered, it needs its own privacy policies, a business associate agreement with the FSA or HRA administrator, a plan amendment and sponsor certification before the employer sees claim detail, and a notice of privacy practices (often combined with the major medical plan’s notice when the employer self-funds both).
A common gap: HR staff reviewing FSA substantiation receipts. Those receipts are PHI of the FSA, so the people seeing them must be on the plan document’s firewall list and kept away from employment decisions. Using a TPA to keep receipts away from the employer is a good design, not a legal requirement.