| 
HIPAA Update
- Compliance for Small Group Health Plans
- Business Associate Contracts
- National Provider Identifiers
By Jason
T. Froggatt, Rebecca
L. Williams, Paul
T. Smith and Robyn Todd
[April 2004]
April brings two HIPAA compliance deadlines. April 14 is the
privacy compliance date for small group health plans--those
with “receipts” of less than $5 million for the
last plan year. It is also the last date for covered entities
to enter into business associate agreements with contractors
who receive or create health information. This update contains
some suggestions for small group health plans, and some lessons
learned from the past year of business associate contracting.
We also include a summary of the final regulation on national
provider identifiers that was published recently.
COMPLIANCE FOR SMALL GROUP HEALTH PLANS
Information—and misinformation—has swirled around
HIPAA privacy compliance since the regulations first were proposed
in 1999. Small group health plans can learn much from the compliance
experiences of their larger counterparts, which were required
to comply a year ago.
For employers sponsoring small group health plans, the following
three steps will assist in determining what you need to do to
make sure your group health plans are compliant with the HIPAA
privacy requirements:
| 1. |
Are You Excluded as a Small Self-Administered
Plan?
HIPAA privacy regulations create an exclusion for group
health plans that have fewer than 50 participants and
are administered by the employer that established and
maintains the plan. Both requirements must be met—plans
that use third-party administrators are covered by HIPAA,
even if they have fewer than 50 participants. Plans that
designate the employer as plan administrator, but receive
administrative services (such as claims adjudication)
from third parties likely are not “self-administered”
either. However, a self-administered health flexible spending
account program or medical reimbursement arrangement may
fall within this exclusion even if the employer’s
medical and dental plans do not. |
2. |
Do You Sponsor Any Insured Plans That Receive Only Limited
Health Information?
The second step in compliance is to determine whether
any of your plans fall within the so-called “fully
insured” exception. Although all group health plans
are covered entities under HIPAA (except for the limited
exclusion described above), group health plans that are
fully insured have only minimal compliance obligations,
as long as they receive no health information other than
enrollment and disenrollment information or summary health
information for the purposes of obtaining premium bids,
or amending or terminating the plan. Such plans do not
have to comply with the use and disclosure rules, do not
have to provide for individual rights, and do not have
to satisfy the administrative requirements imposed under
HIPAA, except for the prohibitions against intimidating
or retaliatory acts and against requiring a waiver of
HIPAA rights.
In particular, this means that if you sponsor a fully-insured
plan that receives only enrollment or disenrollment information
or summary health information, your plan does not have
to appoint a privacy official, prepare or distribute a
privacy notice, amend the plan document, or enter into
business associate contracts. The plan may not need to
take additional compliance measures. |
3. |
Who Is Responsible for HIPAA Compliance for Your Plan
and What Needs to Be Done?
If your plan is covered by HIPAA and is not fully insured,
compliance will consist of the following actions. A fully-insured
plan that receives more than just summary health information
and enrollment and disenrollment information will also
have to comply with respect to the additional information:
- Appoint a Privacy Official and Contact Person.
The privacy official is responsible for HIPAA compliance
for the group health plan. The contact person, who may
be the same as the privacy official, answers questions
and receives complaints relating to privacy.
- Amend Plan Documents. If the employer sponsor
receives protected health information (PHI) in order
to administer its group health plan, the group health
plan must be amended to include provisions that restrict
the sponsor’s use and disclosure of plan information
to necessary plan administration functions. This may
be done in a stand-alone document, or may be incorporated
in a restated plan document. Moreover, the employer,
as plan sponsor, will need to take actions to safeguard
plan-PHI, such as to establish firewalls between plan
and employer functions.
- Prepare Notice of Privacy Practices. The
plan must develop a notice of privacy practices describing
how it uses and disclosures health information, individual
rights, administrative procedures, and other required
elements. For many plans, especially self-insured plans,
the notice must be provided to participants in the plan
prior to April 14, 2004. Thereafter, the group health
plan will need to provide the notice to newly enrolled
participants. If the notice is amended, then the new
notice must be provided to participants within 60 days
of a material change. Bear in mind that if the plan
is fully insured, but receives more health information
than just summary health information and enrollment
and disenrollment information, at a minimum must develop
a notice of privacy practices and provide the notice
when requested. It is not necessarily required to distribute
the notice.
- Develop Policies and Procedures. The regulations
recognize that small employers cannot afford the time
and expense to adopt complex policies and procedures.
They require only that the policies and procedures adopted
be reasonable in light of the size and circumstance
of the group health plan.
- Enter into Business Associate Contracts.
If your plan is administered by a third-party administrator,
the TPA is a business associate of the plan, and the
plan is required to have a contract with the TPA that
requires the TPA to safeguard plan information, to restrict
its use of the information, and to return or destroy
the information on termination of the contract. You
will also need business associate contracts with other
contractors who have access to the plan’s health
information, such as actuaries and attorneys.
|
Many third-party administrators or benefits consultants are
prepared to handle or assist you with group health plan HIPAA
compliance. But you should not assume that they will handle
your HIPAA compliance for you. With respect to most group health
plans, the employer, as plan administrator, will be the fiduciary
that is obligated to insure on-going group health plan compliance
(including HIPAA compliance).
Following these three steps should allow most small group health
plans to quickly determine their HIPAA compliance requirements.
For more detail on the privacy rules, please see "A
Road Map for Employer Compliance with HIPAA" (Spring
2002).
BUSINESS ASSOCIATE CONTRACTS
April 14 is also the deadline for covered entities to amend
or supplement contracts with business associates (BAs) to include
the provisions required by the HIPAA Privacy Rule. These clauses
require BAs to safeguard PHI, restrict uses and disclosures
to those contemplated by the underlying agreement, and to return
or destroy PHI on termination of the contract. Generally, “business
associate” includes any contractor who receives or creates
individually identifiable health information in the course of
assisting the covered entity with operations, including payment.
While they are making these amendments, covered entities should
consider including the additional language required by the final
Security Rule for BAs who handle electronic health information.
While these provisions are not required until 2005, including
them now will avoid another round of revisions. These provisions
can be worked into the existing text at appropriate points.
They must require BAs to:
- adopt administrative, physical and technical safeguards
that reasonably and appropriately protect the confidentiality,
integrity and availability of electronic PHI, and to require
their subcontractors to do the same, and
- report security incidents concerning electronic PHI.
What lessons have been learned from the first round of business
associate contracting?
Not all relationships are the same. While
a standard form of agreement will serve for most BA relationships,
some require special attention. This is particularly true for
BAs who handle many business processes involving PHI, such as
third-party administrators of group health plans. Some thought
should be given to the special risks in these relationships.
Less May be More. That said, a covered entity
should think carefully about adding provisions to the BA agreement
that are not mandated by the regulation. Why? Every additional
provision beyond the required minimum creates a new negotiating
opportunity for the parties, and a new negotiating opportunity
means more time and expense. In our experience, indemnification
clauses have been the greatest source of controversy. Before
insisting on them, covered entities might consider whether common-law
principles of indemnification are not adequate. Conversely,
if the underlying contract substantially limits the BA’s
liability (as many technology contracts do), covered entities
might want to clarify that the limits do not apply to violations
of the BA provisions.
Beware of Subcontractors. The standard contract
provision allows a BA to disclose PHI to its subcontractors
as long as they agree to the same restrictions and conditions
that apply to the BA. This agreement with the subcontractor
need not conform to any particular standards, or even be in
writing. A covered entity may not even know that its BA is disclosing
PHI to subcontractors. In a much-publicized incident, a university
medical center discovered that its medical records had found
their way to a transcriptionist in Pakistan through a chain
of subcontracts. It was reported that the Pakistani transcriptionist
threatened to publish the records on the Internet in a dispute
over payment.
This kind of subcontracting is not forbidden by HIPAA, and
there is nothing in the standard BA contract that would prevent
it. However, the risks to reputation are clear, and individuals
may be able to claim for loss of privacy on grounds other than
HIPAA. Covered entities should consider insisting on express
approval of subcontracting by BAs.
Accounting for Disclosures. How should the
CE gather information about the disclosures made by BAs which
the CE must include in an accounting to an individual? The approach
we most often see is for the BA to maintain the record of disclosures,
and to provide information to the CE on request. A more efficient
approach might be to require BAs to report disclosures to the
CE as they occur, if they would need to be included in an accounting.
This approach would permit the CE to maintain a centralized
record of disclosures, and avoid polling its BAs whenever it
receives a request for an accounting.
NATIONAL PROVIDER IDENTIFIERS
On January 23, 2004, the Centers for Medicare & Medicaid
Services published the “Standard Unique Health Identifier
for Health Care Providers” regulations. As expected, these
final regulations adopt the National Provider Identifier (NPI)
as the unique identifier for health providers for use in standard
transactions and for other lawful purposes. The NPI will replace
the numerous UPINs, Legacy, Medicaid, and other numbers currently
in use.
The NPI has ten all-numeric positions (with the last position
being a check digit). Based on current provider growth, CMS
estimates that unique NPIs will be available for 200 years.
In response to industry concern, the NPI will contain no embedded
information about the provider.
The NPI will be issued by the National Provider System (NPS),
which is being built under a CMS contract. A CMS contractor,
called the “enumerator” – a title that could
wind up in the movies someday – will operate the NPS.
The enumerator will be responsible for receiving (and assisting
providers with) applications, assigning a unique NPI to each
requesting provider, deactivating and reactivating NPIs, updating
information, and generally troubleshooting the NPS. Protections
will be in place to guard against a deactivated number’s
being assigned to another provider.
Only health care providers may receive an NPI. Covered providers
must have an NPI; non-covered providers may request one as well.
For health entities, such as hospitals and health systems with
multiple sites, the regulations allow “subparts”
of a provider organization to apply for separate NPIs.
Covered health providers and most health plans must comply
with these regulations by May 23, 2007, with small health plans
having an additional year to come into compliance. Covered providers
may begin applying for their NPIs on May 23, 2005 (which is
the effective date of these regulations). Recognizing the impending
heavy workload, CMS asks non-covered providers to wait an additional
year or two.
For
more information about how Davis Wright Tremaine LLP can assist
you with your group health plan HIPAA compliance efforts, please
see "What
DWT Can Do,” or contact:
Rebecca
L. Williams, Seattle, (206) 628-7769, beckywilliams@dwt.com
Jason
T. Froggatt, Seattle, (206) 628-7629, jasonfroggatt@dwt.com
Paul
T. Smith, San Francisco, (415) 276-6532, paulsmith@dwt.com
Sarah
L. Bhagwandin, Seattle, (206) 903-3959, sarahbhagwandin@dwt.com
This HIPAA Alert is a publication of
the Health Law Group of Davis Wright Tremaine LLP. Our purpose
in publishing this Alert is to inform our clients and friends
of recent HIPAA developments. It is not intended, nor should
it be used, as a substitute for specific legal advice as legal
counsel may only be given in response to inquiries regarding
particular situations.
© 2004 DWT
LLP | Published by Davis Wright Tremaine LLP
return to Advisory
Bulletins main page |
