Wow! I was wondering where to post this and noticed this HR board. Great!!

We belong to a fully-insured group health plan with our state Bankers Association. I thouht we were not considered a plan administrator since our insurers perform this function, but after further reading I found out that if we assist employees with claim problems and help to determine if a service is covered we are in fact doing some of the duties of a plan adminstrator. Do I need to give a HIPAA privacy notice to my employees (current total of 38) even though we have a privacy notice from our health insurer? And if so, does anyone have one that they would share that I could tailor to my bank? Or point me to a site that has some sample privacy disclosures?

Hi Donna. The December 2000 preamble to the Privacy Rule, the Department of Health and Human Services repeatedly stated that the Privacy Rule does not apply to employers, nor does it apply to the employment functions of covered entities, that is, when they are acting in their role as employers. As an example, the Department stated: Covered entities must comply with this regulation in their health care capacity, not in their capacity as employers. For example, information in hospital personnel files about a nurses' (sic) sick leave is not protected health information under this rule. Hope this helps.
Bob

I think I have it straight now. As long as we don't receive any protected health information other than summary health information and information pertaining to enrollment, we are not impacted by HIPAA Privacy rules. However, HIPAA compliant authorizations will be required if employers seek PHI for complying with disability, COBRA, FMLA, ADA, Workers' Comp and OSHA.

Stressing out over nothing!!

Would your answer change if the plan was self insured? It is my understanding that it would then impact the employer.

It is my understanding that it is when you are doing plan adminstrator duties in addition to plan sponsor that you will be impacted by HIPAA privacy, especially if HR performs all of these duties. You need to create a "firewall" between employment related health information and medical plan protected health information (PHI). This covers health care data that can be linked to an employee's name, SS #, employee number etc. General summarized data is not covered under HIPAA privacy.

There is a good article at benefitnews.com on the difference between self insured plans and group plans -"Time is running out on employers for HIPAA compliance" that you may want to take a look at.

I initially shrugged this off thinking HIPAA privacy requirements did not apply to us but now I am not so sure. There is an A. E. Roberts HIPAA Privacy seminar in my area in a couple of months, and I hope I can convince my CEO to send me. I don't want to be responsible for any possible fines by not doing the right thing through ignorance and confusion.

Donna: Thanks for the HIPAA web site. It has great information.

Donna -
Thanks for the site. I didn't know it existed, I'm sure it will be a good tool hence forth. Seems wether we like it or not we get more involved with HR compliance.

Thanks for the site. Great tool!!