HIPAA Compliance

The Ultimate Employer & Plan Sponsor Resource Kit

Many employers are totally confused and misguided about HIPAA compliance. Even the basics of “who needs to comply” and “what exactly needs to be done” to “when does it need to get done” puts employers at risk for costly mistakes.

And the changes to HIPAA compliance requirements, including the HIPAA HITECH rules complicate matters even more.

The HIPAA Privacy Rule addresses the what, when and with who PHI can be shared while the HIPAA Security Rule deals with the security measures that are needed to protect electronic PHI (ePHI) that is created, received, maintained or transmitted by electronic means (e.g., email, fax, EDI, etc.).

But while most employers understand that HIPAA deals with health-related information, they mistakenly believe that their insurance carrier or claims administrator (TPA) is responsible for HIPAA compliance. An employer’s health plans (including medical, Rx, dental, vision, Spending Accounts, HSA’s and some EAP’s) are required to be HIPAA compliant.

Employers (along with their brokers and related service providers) need solid information on how HIPAA compliance applies to them. HIPAA sets rules for protecting data that contains protected health information (PHI).

There are two parts to HIPAA compliance: the Privacy Rule and the Security Rule. A related HITECH law adds an additional layer as it increases the penalties for violations to the HIPAA Privacy and Security Rules.