Under final rules issued September 5, 2012 by the Department of Health and Human Services under HIPAA, nearly all employer group health plans are required to obtain a unique health plan identification number (HPID) by November 5, 2014. (We summarize the final rules briefly here.) Health plans with less than $5 million in annual receipts have until November 5, 2015 to comply. With less than three weeks to go until the deadline, employers still have questions about the requirements and the application process. From what we have heard from some clients, the application process can take at least a couple of days so don’t wait until November 5 to get started.
Entries in Health Plans (49)
Employer group health plans and other covered entities that have not already amended business associate agreements (BAAs) to incorporate changes required by the Final Omnibus Rule must do so by September 22, 2014. (You can read our prior blog post on the Final HIPAA Omnibus Rule here.)
In January 2013 the Department of Health and Human Services published the Final HIPAA Omnibus Rule. Among other things, the Final Omnibus Rule expanded the scope of entities considered “business associates,” extended direct liability to business associates who fail to comply with certain HIPAA requirements, and required the addition of certain language to new and existing BAAs. Specifically, the Final Omnibus Rule required that existing BAAs be amended and new BAAs be drafted to include (among other things) provisions requiring a business associate to:
- Comply with applicable provisions of the HIPAA security rule;
- Ensure that any subcontractor creating, receiving, maintaining, or transmitting protected health information (PHI) on behalf of the business associate agrees in writing to the same restrictions and conditions that apply to the business associate with respect to such information;
- Report to the covered entity breaches of unsecured PHI as required by the breach notification rules; and
- To the extent the business associate carries out a covered entity’s obligations under the privacy rule, comply with the requirements of the privacy rule that apply to the covered entity in the performance of such obligations.
New and existing BAAs were required to comply with the Final Omnibus Rule by September 23, 2013, though parties with a BAA in place prior to January 25, 2013 were given the opportunity to delay amending the BAA for an additional year. Specifically, if, prior to January 25, 2013 (the publication date of the Final Omnibus Rule), the covered entity and the business associate were parties to a BAA that complied with the prior provisions of the HIPAA rules and the BAA was not renewed or modified after March 25, 2013, the parties could delay amendment of the BAA until September 22, 2014.
Employers who sponsor self-funded group health plans should review their existing BAAs to ensure that they comply with the Final Omnibus Rule. (HHS has provided sample language.) One final thought. Since the Final Omnibus Rule makes clear that covered entities may be liable for the acts of their business associates functioning in an agent capacity, employers should consider adding language to their BAAs to affirmatively disavow any agency relationship with a business associate in appropriate cases. This type of protective provision does not appear in the model language published by HHS, but competent legal counsel certainly can provide it.
As 2013 draws to a close and we look ahead to 2014, there is no shortage of benefit plan administrative challenges with which employers must contend. While the Patient Protection and Affordable Care Act of 2010 (“ACA”) remains very much at the forefront of these challenges, retirement plan and deferred compensation plan administration continue to require attention. With that in mind, we offer the following non-exhaustive summary of key legal compliance matters to keep in mind while closing out this year and planning for next year.
Health Care Reform Update
Despite the waves of political and judicial attacks that are not expected to let up – and the missteps that marred the roll out of HealthCare.gov – the ACA continues to be the law of the land. The implementation of some important components of the ACA has been delayed, however, and some elements of the law have been modified. Beyond well-publicized notice and other requirements that took effect earlier this year, employers should take note of the following:
Late last week the IRS released Notice 2013-71, modifying the health flexible spending account (“health FSA”) use-it-or-lose-it rule to allow participants to carry over up to $500 in unused health FSA funds. Although not unexpected (the Service has hinted at such a change a number of times over the past year), this new feature is welcome relief to participants and plan sponsors. Plan sponsors may adopt this optional amendment effective as early as the 2013 plan year.
Notice 2013-71 provides that a plan sponsor may, at its option, allow a participant to carry over up to $500 of unused health FSA funds to the immediately following plan year. Unused health FSA funds are those remaining at the end of the plan’s run-out period (if any), and do not count against the limit on participant salary reduction contributions. Accordingly, a participant could elect to contribute the full $2,500 (as indexed in future years) permitted by law and also carryover as much as $500.
An employer wishing to adopt this new carryover feature must...
Developments in the employee health plan arena have come fast and furious in the first half of 2013, and there is no lack of compliance activities to occupy the time of human resources and employee benefits professionals. We offer this collection of key developments for employers to consider as they move into the second half of 2013.
Health Care Reform
While the federal agencies charged with implementing the Affordable Care Act have kept up the impressive pace of publishing regulations and other guidance, the most significant development in this area was the decision of the Obama administration to delay enforcement of the employer mandate. The meaning and scope of this temporary reprieve are explained briefly below. “Large employers” that will be subject to the employer shared responsibility mandate should use this extra time to make thoughtful preparations to comply with the mandate, and employers at or near the 50-employee threshold should use the extra time to determine whether their business plans may result in the need to comply with the mandate. Key issues include the following:
- Delay in enforcement of the employer mandate. The federal government has delayed employer shared responsibility reporting obligations and penalties until 2015. Accordingly, businesses will not be penalized in 2014 for failure to offer their full-time employees health coverage that is affordable and meets minimum value requirements. Despite the postponement in reporting, employers are still required to provide individual requesting employees with certain information that will assist the IRS in determining whether the employee is eligible for a premium tax credit. As further discussed below, the delayed enforcement of the employer mandate does not affect...