Employee Benefits Update Re: Health Plans and HIPPA Violations

Employee Benefits Update Re: Health Plans and HIPPA Violations

Fulcrum Partners Executive Benefits News

This employee benefits update (first published May 2019)  is provided courtesy of Isler Dare PC (www.islerdare.com) and was written by Andrea I. O’Brien, Vi D. Nguyen, Jeanne Floyd, and Ashley F. Hedge.

Recent Legal Developments for Employee Benefit Plans

Executive Summary

  • Status of Association Health Plans: The Department of Labor will be appealing a federal court decision setting aside most of the final regulations authorizing the establishment of Association Health Plans, effectively putting the development of new Association Health Plans on hold.
  • Reduced Fines for Health Insurance Portability and Accountability Act of 1996[i] (HIPAA) Violations: The Department of Health and Human Services has significantly reduced the maximum penalty amounts for most violations of HIPAA’s privacy and security rules.

Department of Labor Will Appeal Association Health Plan Ruling

In June 2018, the Department of Labor issued a final rule regarding Association Health Plans (“AHPs”), which expanded the opportunity for small businesses, including self-employed workers, to band together by geography or industry to obtain healthcare coverage as if they were a single large employer. This final rule was in response to President Trump’s executive order on October 12, 2017 to encourage the expansion of AHPs for small businesses and the self-employed.

On March 28, 2019, the U.S. District Court for the District of Columbia invalidated a majority of the provisions of the final AHP rule. In particular, the Court took issue with the provision that allows AHPs to be formed solely on the basis of geography or for the purpose of selling insurance. The Department of Labor[ii] (DOL) has announced that it will appeal the Court’s decision, and in the meantime has released guidance to AHPs that were already established before the Court’s decision, requiring such AHPs to continue providing coverage and paying claims. However, for AHPs that have not yet been established, the appeal of the Court’s ruling has effectively put the development of any new AHPs on hold.

Reduced Fines for HIPAA Privacy and Security Violations

In the wake of record-setting fines for violations of the privacy and security rules under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Department of Health and Human Services is reducing the maximum fines for certain HIPAA privacy and security violations, effective immediately.

Type of HIPAA Breach of

Privacy or Security Rule

Prior Maximum Penalty New Maximum Penalty
Violation due to willful neglect and not corrected $50,000 per violation up to

$1.5 million total per year

$50,000 per violation up to $1.5 million total per year (unchanged)
Violation due to willful neglect but violation is corrected $10,000 to $50,000 per violation up to $1.5 million total per year $10,000 to $50,000 per violation up to $250,000 per year
Violation due to reasonable cause $1,000 to $50,000 per violation up to $1.5 million total per year $1,000 to $5,000 per violation up to $100,000 per year
Did not know of violation and by exercising reasonable diligence would not have known $100 to $50,000 per violation up to $1.5 million total per year $100 to $50,000 per violation up to $25,000 per year

The maximum penalty per violation still will vary depending on the entity’s culpability and appropriate correction of the violation. Despite the reduction in fines, entities subject to HIPAA, such as employer-sponsored group health plans, should remain diligent about maintaining appropriate HIPAA safeguards to ensure the privacy and security of protected health information, and taking prompt action if a breach or other violation occurs.

[i] Added to article for reader clarification of acronym HIPPA

[ii] Added to article for reader clarification of acronym DOL

Securities offered through Lion Street Financial, LLC (LSF) and Valmark Securities, Inc. (VSI), each a member of FINRA and SIPC. Investment advisory services offered through CapAcuity, LLC; Lion Street Advisors, LLC (LSF) and Valmark Advisers, Inc. (VAI), each an SEC registered investment advisor. Please refer to your investment advisory agreement and the Form ADV disclosures provided to you for more information. VAI/VSI, LSF and BDO Alliance USA are non-affiliated entities and separate entities from Fulcrum Partners and CapAcuity, LLC.

#HIPPA #EmployeeBenefits #FulcrumPartners