Health FSAs Are Subject To The HIPAA Privacy Rule

Prior to the April 14, 2003 deadline for compliance with the Health Insurance Portability and Accountability Act (“HIPAA”) Privacy Rule, the U.S. Department of Health and Human Services (“DHHS”) was considering whether a Health Flexible Spending Arrangement (“Health FSA”), also known as a Health Care Reimbursement Account, is a “health plan” that would need to comply with the HIPAA Privacy Rule. On April 24, 2003, DHHS announced its conclusion that, because a Health FSA is an ERISA employee welfare benefit plan that pays for medical care, it is a health plan and thus a covered entity under the HIPAA Privacy Rule. Accordingly, employers that sponsor a Health FSA will need to review the Health FSA’s compliance with the HIPAA Privacy Rule.

If your Health FSA is self-funded, self-administered and has less than 50 participants, it is exempt from the HIPAA Privacy Rule. In addition, many Health FSAs will be eligible for a compliance extension (to April 14, 2004) as small health plans. A small health plan is one with less than $5 million of annual receipts (claims paid) during the prior plan year. If your Health FSA is a small health plan, you should make arrangements to ensure that it complies with the HIPAA Privacy Rule by April 14, 2004. If your Health FSA is not exempt and does not qualify as a small health plan (that is, it had annual receipts in 2002 of more than $5 million), you should take immediate steps to comply with the HIPAA Privacy Rule if not currently in compliance. It is unclear whether a Health FSA, which would qualify on its own for the small health plan compliance extension but is part of a larger comprehensive wrap plan which does not meet the small health plan requirements, can take advantage of the small health plan compliance extension.

If you need assistance in complying with the HIPAA Privacy Rule or have questions about whether your Health FSA needs to comply or how to comply, please contact the attorney you work with at Dorsey & Whitney LLP. If you are a Dorsey & Whitney LLP client that does not regularly work with an employee benefits lawyer at Dorsey & Whitney LLP, you can also contact Mike Punt, the Employee Benefits Department’s Communications Coordinator, at 612-340-2867, to be connected to an attorney.

Copied to clipboard