Question: My company is an applicable large employer (ALE) with a self-insured health plan. What steps must we take under the Health Insurance Portability and Accountability Act (HIPAA), specifically its privacy rule, when we report enrollment information for employees and dependents on Form 1095-C?

Answer: You should follow the HIPAA rules that apply to disclosures of protected health information (PHI) from a group health plan to the plan sponsor for plan administration purposes.

Internal Revenue Code Section 6055 requires providers of minimum essential coverage to report the name, taxpayer identification number and months of coverage for all individuals enrolled in the plan providing that minimum essential coverage. For a self-insured health plan, Sec. 6055 regulations impose the reporting obligation on the employer sponsoring the plan. When it comes to ALEs, such as your company, the employer satisfies the reporting obligation by reporting enrollment information on Part III of Form 1095-C.

Technical Requirements

The HIPAA privacy rule allows a group health plan to share PHI with the plan sponsor to the extent that the plan sponsor performs plan administration functions. Sec. 6055 reporting is a plan administration function performed by the plan sponsor. Thus, HIPAA allows the group health plan to disclose enrollment information to the plan sponsor so that the sponsor may satisfy the Sec. 6055 reporting obligation with respect to the plan.

A number of technical requirements, however, must be satisfied before these disclosures may be made by the health plan to the plan sponsor. For example, group health plan documents must be amended to establish permitted and required uses and disclosures of PHI by the plan sponsor. What's more, the sponsor must agree not to use or disclose PHI for employment-related actions or in connection with any other benefit or employee benefit plan of the plan sponsor.

In addition, the sponsor must establish a firewall between those employees who will have access to PHI to perform plan administration functions and all other employees of the plan sponsor. If you hire a third party to file Form 1095-C on your behalf, consider whether that third party is a business associate of the plan and whether you need to enter into a business associate contract with the third party before you disclose enrollment information.

Offers of Coverage

Along with requiring re-enrollment information under Sec. 6055, the Internal Revenue Code requires ALEs to report information about offers of coverage to full-time employees (and their dependents) under Sec. 6056. This information is reported on Part II of Form 1095-C.

Information about offers of coverage to your employees should be available from your employment records (rather than your health plan). Because employment records generally don't include PHI, reporting this information should not implicate HIPAA's privacy rule.

If you have questions about HIPAA, please contact Ron Present, Partner and Health Care Industry Group Leader, at rpresent@bswllc.com or 314.983.1358, or  Anthony Munns, Partner, HIPAA and IT Security Services, at 314.983.1297 or amunns@bswllc.com.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.