Some organizations are bringing their employee health plan options in house as a self-insured group health plan. Although, this conversion may not be right for certain companies based on several reasons and issues. Our short and to the point blog article will provide a quick overview.

According to information provided by the Employee Benefit Research Institute in 2023:

• The percentage of private-sector establishments offering a self-insured health plan increased through 2016 but has since ebbed and flowed with no discernible long-term trend.
• Recent trends have been more clearly defined when examined by firm size.
• Since 2018, the percentages of small and medium-sized establishments offering at least one self-insured plan both increased. In contrast, the percentage of large establishments offering a self-insured plan has declined. The decline among large establishments occurred in most years since 2013.
• Overall, the percentage of workers in self-insured plans has been bouncing around between 58 percent and 60 percent since 2010 but fell to 55 percent in 2022. This occurred despite the increase in self-insurance among small and medium-sized companies because of the drop in self-insurance among large firms.

When going the route of becoming a self-insured group health plan, it now opens the door to meeting HIPAA requirements as a Covered Entity. Here is some information you will find helpful on this topic.

A self-insured group health plan is one in which an employer takes on the financial risk of providing healthcare benefits to its employees, rather than purchasing a traditional “fully-insured” plan from an insurance carrier. Here’s how it works:

1. Financial Risk: The employer sets up a special trust fund or uses general funds to cover incurred claims. They assume the financial risk associated with healthcare expenses.
2. Administration: The employer may administer the plan themselves or hire a third-party administrator (common for larger employers).
3. Coverage: Self-insured plans can include not only traditional health coverage but also medical expense reimbursement flexible spending account plans (medical FSAs) and health reimbursement account plans (HRAs).

HIPAA Compliance for Self-Insured Group Health Plans

HIPAA imposes requirements on Covered Entities, which include health plans, healthcare providers, and health care clearinghouses. Self-insured group health plans fall under this umbrella. Here are key points regarding HIPAA compliance for self-insured plans:

1. Privacy and Security Rules: The HIPAA Privacy Rule and the HIPAA Security Rule set national standards for the privacy of individually identifiable health information and the security of electronic Protected Health Information (ePHI) at transit and at rest.
2. Breach Notification Rule: Added in 2009, this rule mandates reporting of breaches involving PHI.
3. Exemptions:Exemptions from HIPAA compliance for self-insured companies are rare. Only if a self-insured group health plan is self-administered, has fewer than fifty employees, and administers medical FSAs and HRAs internally, is it exempt from HIPAA compliance.
4. Partial Compliance: Some self-insured plans fall into a gray area known as “partial compliance.” These plans occur when neither the sponsor nor its insurance agent has access to or transmits PHI electronically.

HIPAA Compliance for Self-Insured Plans

There are many requirements an organization will need to meet in standing up a HIPAA compliance program. This includes:

1. Appoint Officers: Designate a Privacy Officer and a Security Officer.
2. Develop Policies: Create HIPAA privacy policies and procedures to be included in a Risk Management Plan.
3. Business Associate Agreements: Ensuring these BAAs are in place with any vendor who can access your organization’s protected health information.
4. Risk Assessment: Conduct regular security, privacy, and breach risk assessments to identify vulnerabilities. A security risk assessment is required by the HIPAA Security Rule.
5. Training: Provide HIPAA Security Awareness and Privacy Training to appropriate members of your workforce.
6. Breach Response: Establish protocols for breach notification and response.

Compliance requirements will be based on the organization’s business operations, structure, and size. If your organization is planning to become a self-insured health plan and needs to understand the regulatory requirements of HIPAA to safeguard sensitive health information, please contact our office for a free, initial consultation. We have helped many small organizations implement, maintain, and manage a comprehensive HIPAA compliance program as a Covered Entity.