[Client Alert]: 2021 Adjustments for ACA’s OOP Limits, Penalty Amounts, and Affordability

HHS Announces OOP Limitations for 2021

With the passage of the Affordable Care Act (ACA), group health plans became required to apply an out-of-pocket limitation to certain in-network benefits… meaning that once an individual or family out-of-pocket (OOP) limit was met, the plan could not charge additional OOP costs for essential health benefits. These OOP limits include both the plan’s deductible as well as cost-sharing amounts for essential health benefits (EHB) in-network as set forth under the ACA.

Although self-insured plans and large-group insured plans are not required to cover all EHBs (while small-group insured plans are), to the extent they do, in-network OOP expenses for EHBs cannot exceed the maximum OOP limit. Additionally, group health plans may not impose annual or lifetime dollar limitations on EHBs whether offered in-network or out-of-network.

The Department of Health and Human Services (HHS) has released the 2021 plan year inflation-adjusted OOP limits applicable to non-grandfathered plans.

  • Self-only coverage:      $8,550 (was $8,150 for 2020)
  • Family coverage:         $17,100 (was $16,300 for 2020)

See PPACA; HHS Notice of Benefit and Payment Parameters for 2021.

Employers with non-grandfathered group health plans must update their maximum annual OOP limits.

These rules do not apply to ACA grandfathered plans. [Please note that these cost-sharing limits are different than the maximum out-of-pocket limits for purposes of being HSA-qualifying high deductible health plans.]

HHS Announces ACA Employer Mandate (Pay or Play) Penalty Amounts for 2021

Under the ACA, applicable large employers must offer certain group health plan coverage to their full-time employees; otherwise they will risk significant penalties.

Applicable large employers are those who employ 50 or more full-time or full-time equivalent employees in the preceding calendar year. Employees of related employers (within a controlled group or affiliated service group) are counted in this determination.

  • Part A requires employers to offer minimum essential coverage to 95% of their full-time employees.  See Section 4980H(a).
  • Part B requires the offered coverage be affordable and meet the minimum value standards.  See Section 4980H(b).

Specifically, the Part A Penalty is imposed on an employer who fails to offer minimum essential coverage (MEC) to at least 95% of the employer’s full-time employees (FTEs) and dependents as defined under the ACA, and if one of its FTEs receives subsidized coverage through the Marketplace or public health insurance exchange. The penalty amount is multiplied by the number of FTEs, minus 30. Special rules exist for applicable large employer members which are part of a controlled group.

The Part B Penalty amount is imposed on an employer who fails to offer coverage that meets the minimum value (MV) requirements or fails to be affordable, again as defined under the ACA, with respect to each one of its FTEs who receives subsidized coverage through the Marketplace or public health insurance exchange.

The Internal Revenue Service (IRS) has released the 2021 inflation-adjusted penalty amounts under the Affordable Care Act’s Employer Shared Responsibility Mandate (Pay or Play):

  • Part A Penalty:     $2,700 (was $2,570 for 2020)
  • Part B Penalty:     $4,060 (was $3,860 for 2020)

See Q&A 55 on Employer Shared Responsibility Provisions under the ACA.

Specifically, HHS finalized the premium adjustment percentage as 1.3542376277 for the 2021 benefit year, which is then multiplied by the original 2015 penalty amounts (Part A was $2,000 and Part B was $3,000) and rounded down to the nearest multiple of ten.

By way of example, an employer with 200 FTEs who fails to offer MEC to 95% of those employees (and if at least one of those FTEs receives subsidized coverage through the Marketplace or an exchange), the penalty assessed for the year will be $459,000 (200-30 = 170 x $2,700). The larger the employer, the larger the penalty.  If the same employer offers coverage to 95% of its FTEs but that coverage is not affordable or doesn’t provide minimum value, the penalty assessed will be based on the number of employees who receive subsidized coverage through the Marketplace or an exchange. If 20 FTEs receive subsidized coverage for each month of the year, the 2021 penalty would be $81,200 ($4,060 x 20).

Affordability Rates for 2021

As discussed above with respect to ACA penalties, an applicable large employer who does not offer affordable employer-sponsored group health plan coverage could face steep penalties.

For 2021, the ACA affordability requirement applies to the lowest-cost self-only coverage option that offers minimum value and must not exceed 9.83 percent of an employee’s household income. Please see Rev. Proc. 2020-36. This is a increase from 2020 (which was 9.78%).

As it is difficult to determine an employee’s household income, three safe-harbors are available for employers to use to determine affordability:

  1. Form W-2, based on an employee’s W-2 wages as reported in Box 1;
  2. Rate of Pay, based on the employee’s hourly wage rate, multiplied by 130 hours per month; and
  3. Federal Poverty Line, based on the individual federal poverty level as of six months prior to the beginning of the plan year, divided by 12…

Employers must be sure to carefully consider the safe harbors available and calculation of the lowest-cost employee coverage that should be charged.

This alert serves as a general summary, and does not constitute legal guidance. Please contact us with any specific questions.


We have created a response team to the rapidly changing COVID-19 situation and the law and guidance that follows, so we will continue to post any new developments. You can view our COVID-19 Response Page and additional resources by following the link here. In the meantime, if you have any questions, please contact your Fraser Trebilcock attorney.


Elizabeth H. Latchana specializes in employee health and welfare benefits. Recognized for her outstanding legal work, in both 2019 and 2015, Beth was selected as “Lawyer of the Year” in Lansing for Employee Benefits (ERISA) Law by Best Lawyers, and in 2017 as one of the Top 30 “Women in the Law” by Michigan Lawyers Weekly. Contact her for more information on this reminder or other matters at 517.377.0826 or elatchana@fraserlawfirm.com.


Brian T. Gallagher is an attorney at Fraser Trebilcock specializing in ERISA, Employee Benefits, and Deferred and Executive Compensation. He can be reached at (517) 377-0886 or bgallagher@fraserlawfirm.com.

Client Alert: COVID-19 Group Health Plan Service & Notification Requirements

On April 11, 2020, the Departments of Labor, Health and Human Services, and Treasury (Departments) jointly released frequently asked questions (FAQs) regarding health care coverage issues surrounding the implementation of the FFCRA and the CARES Act. See Joint FAQs.

Notably, the Departments maintain that the FAQs are a statement of policy and are effective immediately.

The Families First Coronavirus Response Act (FFCRA) was enacted on March 18, 2020 and requires health plans and insurers to provide certain items and services related to diagnostic testing for detection of SARS-CoV-2 or the diagnosis of COVID-19 without cost sharing or prior authorization from March 18, 2020 and during the applicable emergency period. The Coronavirus Aid, Relief, and Economic Security Act (CARES Act) was enacted on March 27, 2020 and broadened the range of diagnostic items and services that plans and issuers must cover. These FAQs represent the Departments’ approach to assist employers, issuers, providers and other stakeholders to come into compliance as well as to help families understand the new laws.

Applicable Plans

The FFCRA and CARES Act apply to group health plans and health insurance issuers offering group or individual health insurance coverage. The term “group health plan” includes both insured and self-insured group health plans, whether they are ERISA plans, non-federal governmental plans or church plans. The term “individual health insurance coverage” includes individual market coverage through or outside of an Exchange. It also includes student health insurance coverage.

However, short-term, limited-duration insurance is not subject… neither are excepted benefits or plans covering less than two employees (such as retiree-only plans).

Duration of Compliance

The FFCRA provisions are effective March 18, 2020 and continue during the public health emergency.

Required Items & Services

Q3-Q5 address the type of items and services that are required under the FFCRA and CARES Act, including:

  • in vitro diagnostic test (meeting certain requirements) for the detection of SARS-CoV-2 or the diagnosis of COVID-19, and the administration of such tests; this includes serological tests for COVID-19, which are used to detect antibodies against the SARS-CoV-2 virus; and 
  • items and services furnished to an individual during health care provider office visits (including in-person and telehealth visits), urgent care center visits, and emergency room visits that result in an order for or administration of an in vitro diagnostic product, but only to the extent the items and services relate to the furnishing or administration of the product or to the evaluation of the individual for purposes of determining the need of the individual for such product.

The required benefits must be furnished during office visits. The Departments construe the term “visit” broadly and include non-traditional care settings, such as drive-through screenings. See Q8.

Additionally, a recent IRS Notice issued just days ago states that testing and treatment for COVID-19 includes “the panel of diagnostic testing for influenza A & B, norovirus and other coronaviruses, and respiratory syncytial virus (RSV) and any items or services required to be covered with zero cost sharing under … the CARES Act.” See IRS Notice 2020-29.

Notice 2020-29 also separately expands Notice 2020-15 to provide that reimbursement of expenses for testing and treatment of COVID-19 incurred on or after January 1, 2020 will not result in a high deductible health plan (HDHP) to fail to be an HDHP under Code section 223.

Cost-Sharing Requirements

Cost-sharing requirements (including deductibles, copayments and coinsurance), prior authorization requirements, and medical management requirements cannot be imposed for benefits that must be provided under section 6001(a) of the FFCRA, as amended by section 3201 of the CARES Act.

With regard to out-of-network providers, Q7 of the Joint FAQs provides that plans and issuers are required to provide coverage for such items and services even if providers have not agreed to accept a negotiated rate as payment in full. In such case, a cash price equal to the service as listed b the provider on a public internet website must be provided (or another amount may be negotiated for less than such cash price).

Summary of Benefits and Coverage (SBC) Requirements & Mid-Year Changes

While material modifications to the SBC normally require that the plan provide 60 days advance notice, the Departments state that they will not take enforcement action regarding greater coverage of COVID-19 diagnosis and/or treatment, as long as plans and issuers provide notice of the changes as soon as reasonably practicable. This non-enforcement policy applies only while the COVID-19 public health emergency and/or COVID-19 national emergency declaration is in affect. Coverage changes beyond this emergency period must fully comply.

State Standards

States may impose additional standards or requirements on health insurance issuers regarding COVID-19 diagnosis or treatment, as long as they do not prevent application of a federal requirement.

Excepted Benefits

The FAQs describe types of excepted benefits, including employee assistance programs (EAPs), and provide that COVID-19 diagnosis and testing offered under an EAP will not jeopardize that EAP’s excepted benefit status while the COVID-19 public health or national emergency declaration is in effect. Additionally on-site medical clinics offering COVID-19 diagnosis and testing will remain excepted benefits.

Telehealth & Remote Care Services

The Departments maintain that widespread use of telehealth and other remote care services are essential to fight the ongoing COVID-19 pandemic, and they strongly encourage all plans and issuers to promote and notify individuals about these services.

The CARES Act has already offered flexibility with regard to high deductible health plans (HDHPs) and health savings accounts (HSAs)… stating that use of telehealth and other remote care services prior to the deductible being met will not jeopardize HDHP status, even if their use is not for COVID-19 related reasons. Moreover, individuals using telehealth or other such services outside of the HDHP may also still contribute to HSAs. The CARES Act amended Internal Revenue Code section 223(c) in this respect and will remain in effect from March 27, 2020 and for plan years beginning on or before December 31, 2021.

However, subsequently released IRS Notice 2020-29, mentioned above, provides that telehealth and other remote care services provided on or after January 1, 2020 (and applying for plan years beginning on or before December 31, 2021) will not affect HDHP status, expanding on the CARES Act which previously applied this rule effective as of March 27, 2020.

Similar to guidance previously stated in these FAQs, plans and issuers who add benefits (or reduce or eliminate cost sharing) for telehealth and other remote care services will temporarily be deemed not to violate notice of material modifications requirements or mid-year change restrictions. The Departments will apply the same non-enforcement policy as described above but only during the emergency declaration and only as long as notice is provided as soon as reasonably practicable.

Participant Communication and Lawsuits

Please keep in mind this is a Department non-enforcement policy and does not protect employers and plans from participant lawsuits.

As you are well aware, the law and guidance are rapidly evolving in this area. Please check with your Fraser Trebilcock attorney for the most recent updates.

This alert serves as a general summary, and does not constitute legal guidance. Please contact us with any specific questions.


We have created a response team to the rapidly changing COVID-19 situation and the law and guidance that follows, so we will continue to post any new developments. You can view our COVID-19 Response Page and additional resources by following the link here. In the meantime, if you have any questions, please contact your Fraser Trebilcock attorney.


Elizabeth H. Latchana specializes in employee health and welfare benefits. Recognized for her outstanding legal work, in both 2019 and 2015, Beth was selected as “Lawyer of the Year” in Lansing for Employee Benefits (ERISA) Law by Best Lawyers, and in 2017 as one of the Top 30 “Women in the Law” by Michigan Lawyers Weekly. Contact her for more information on this reminder or other matters at 517.377.0826 or elatchana@fraserlawfirm.com.


Brian T. Gallagher is an attorney at Fraser Trebilcock specializing in ERISA, Employee Benefits, and Deferred and Executive Compensation. He can be reached at (517) 377-0886 or bgallagher@fraserlawfirm.com.

Client Alert: COVID-19 Related Guidance and Effect on Group Health Plans

The government is quickly issuing guidance to address the overwhelming concerns over the coronavirus pandemic and to cover testing and treatment of COVID-19. Below are highlights involving recent changes affecting group health plans.

FFCRA’s Health Provisions

This past Wednesday, March 18, 2020, the Families First Coronavirus Response Act (“FFCRA”) was signed into law.  In part, the FFCRA requires coverage of testing for COVID-19. Specifically, group health plans (including grandfathered plans) and health insurance issuers offering group or individual health insurance coverage must provide coverage, without cost sharing or prior authorization or medical management requirements, for the following items and services:

  • Certain diagnostic products for the detection of SARS-CoV-2 or the diagnosis of the virus causing COVID-19 approved or authorized under certain provisions of the Federal Food, Drug and Cosmetic Act; and
  • Items and services furnished to an individual during health care provider office visits, urgent care and emergency room visits relating to furnishing or administration of the above diagnostic products or to evaluate that such individual needs the product.

These requirements are effective on March 18, 2020 for services and items furnished on or after March 18, 2020.

High Deductible Health Plans, HSAs, and COVID-19

The IRS has issued Notice 2020-15 to address concerns over medical expenses and testing relating to COVID-19. The link to the Notice can be found here: https://www.irs.gov/pub/irs-drop/n-20-15.pdf

Specifically, the Notice provides that a qualifying high deductible health plan (“HDHP”) with accompanying health savings accounts (“HSAs”) will not lose its qualifying HDHP status if it provides health benefits associated with testing for and treatment of COVID-19 prior to the deductible being met. IRS Notice 2020-15 states, in relevant part:

Part of the response to COVID-19 is removing barriers to testing for and treatment of COVID-19. Due to the nature of this public health emergency, and to avoid administrative delays or financial disincentives that might otherwise impede testing for and treatment of COVID-19 for participants in HDHPs, this notice provides that all medical care services received and items purchased associated with testing for and treatment of COVID-19 that are provided by a health plan without a deductible, or with a deductible below the minimum annual deductible otherwise required under section 223(c)(2)(A) for an HDHP, will be disregarded for purposes of determining the status of the plan as an HDHP.

Therefore, an employee participating in such a HDHP will not be disqualified from contributing to HSAs merely because the plan provided no or low-deductible health benefits for testing and treatment of COVID-19.

Catastrophic Plans and COVID-19

The Department of Health and Human Services (“HHS”) has issued guidance stating that, although catastrophic plans may not provide coverage of essential health benefits before the deductible being met (except as otherwise required), it will not take enforcement action against any health insurance issuer that does so for the purposes of diagnosing and/or treating COVID-19:

To facilitate the nation’s response to COVID-19, until further notice, HHS will not take enforcement action against any health insurance issuer that amends its catastrophic plans to provide pre-deductible coverage for services associated with the diagnosis and/or treatment of COVID-19.

Please see https://www.cms.gov/CCIIO/Resources/Files/Catastrophic-Coverage-of-COVID-19.pdf.

Needless to say, the law and guidance are rapidly evolving in this area. Please check with your Fraser Trebilcock attorney for the most recent updates.

This alert serves as a general summary, and does not constitute legal guidance. Please contact us with any specific questions.


Elizabeth H. Latchana, Attorney Fraser TrebilcockElizabeth H. Latchana specializes in employee health and welfare benefits. Recognized for her outstanding legal work, in both 2019 and 2015, Beth was selected as “Lawyer of the Year” in Lansing for Employee Benefits (ERISA) Law by Best Lawyers, and in 2017 as one of the Top 30 “Women in the Law” by Michigan Lawyers Weekly. Contact her for more information on this reminder or other matters at 517.377.0826 or elatchana@fraserlawfirm.com.

Client Alert: 2020 Adjustments for ACA’s OOP Limits, Penalty Amounts, and Affordability

Government has Issued the 2020 Adjustments for ACA’s OOP Limits, Penalty Amounts, and Affordability

HHS Announces OOP Limitations for 2020

With the passage of the Affordable Care Act (ACA), group health plans became required to apply an out-of-pocket limitation to certain in-network benefits… meaning that once an individual or family out-of-pocket (OOP) limit was met, the plan could not charge additional OOP costs for essential health benefits. These OOP limits include both the plan’s deductible as well as cost-sharing amounts for essential health benefits (EHB) in-network as set forth under the ACA.

Although self-insured plans and large-group insured plans are not required to cover all EHBs (while small-group insured plans are), to the extent they do, in-network OOP expenses for EHBs cannot exceed the maximum OOP limit. Additionally, group health plans may not impose annual or lifetime dollar limitations on EHBs whether offered in-network or out-of-network.

The Department of Health and Human Services (HHS) has released the 2020 plan year inflation-adjusted OOP limits applicable to non-grandfathered plans.

  • Self-only coverage:      $8,150 (was $7,900 for 2019)
  • Family coverage:         $16,300 (was $15,800 for 2019)

See https://www.govinfo.gov/content/pkg/FR-2019-04-25/pdf/2019-08017.pdf.

Employers with non-grandfathered group health plans must update their maximum annual OOP limits.

These rules do not apply to ACA grandfathered plans. [Please note that these cost-sharing limits are different than the maximum out-of-pocket limits for purposes of being HSA-qualifying high deductible health plans.]

HHS Announces ACA Employer Mandate (Pay or Play) Penalty Amounts for 2020

Under the ACA, applicable large employers must offer certain group health plan coverage to their full-time employees; otherwise they will risk significant penalties.

Applicable large employers are those who employ 50 or more full-time or full-time equivalent employees in the preceding calendar year. Employees of related employers (within a controlled group or affiliated service group) are counted in this determination.

  • Part A requires employers to offer minimum essential coverage to 95% of their full-time employees.  See Section 4980H(a).
  • Part B requires the offered coverage be affordable and meet the minimum value standards.  See Section 4980H(b).

Specifically, the Part A Penalty is imposed on an employer who fails to offer minimum essential coverage (MEC) to at least 95% of the employer’s full-time employees (FTEs) and dependents as defined under the ACA, and if one of its FTEs receives subsidized coverage through the Marketplace or public health insurance exchange. The penalty amount is multiplied by the number of FTEs, minus 30. Special rules exist for applicable large employer members which are part of a controlled group.

The Part B Penalty amount is imposed on an employer who fails to offer coverage that meets the minimum value (MV) requirements or fails to be affordable, again as defined under the ACA, with respect to each one of its FTEs who receives subsidized coverage through the Marketplace or public health insurance exchange.

The Department of Health and Human Services (HHS) has released the 2020 inflation-adjusted penalty amounts under the Affordable Care Act’s Employer Shared Responsibility Mandate (Pay or Play):

  • Part A Penalty:                  $2,570 (was $2,500 for 2019)
  • Part B Penalty:                  $3,860 (was $3,750 for 2019)

Specifically, HHS finalized the premium adjustment percentage as 1.2895211380 for the 2020 benefit year, which is then multiplied by the original 2015 penalty amounts (Part A was $2,000 and Part B was $3,000) and rounded down to the nearest multiple of ten.

By way of example, an employer with 200 FTEs who fails to offer MEC to 95% of those employees (and if at least one of those FTEs receives subsidized coverage through the Marketplace or an exchange), the penalty assessed for the year will be $436,900 (200-30 = 170 x $2,570).  The larger the employer, the larger the penalty.  If the same employer offers coverage to 95% of its FTEs but that coverage is not affordable or doesn’t provide minimum value, the penalty assessed will be based on the number of employees who receive subsidized coverage through the Marketplace or an exchange.  If 20 FTEs receive subsidized coverage for each month of the year, the 2020 penalty would be $77,200 ($3,860 x 20).

Affordability Rates for 2020

As discussed above with respect to ACA penalties, an applicable large employer who does not offer affordable employer-sponsored group health plan coverage could face steep penalties.

For 2020, the ACA affordability requirement applies to the lowest-cost self-only coverage option that offers minimum value and must not exceed 9.78 percent of an employee’s household income. Please see Rev. Proc. 2019-29. https://www.irs.gov/pub/irs-drop/rp-19-29.pdf. This is a decrease from 2019 (which was 9.86%).

As it is difficult to determine an employee’s household income, three safe-harbors are available for employers to use to determine affordability:

  1. Form W-2, based on an employee’s W-2 wages as reported in Box 1;
  2. Rate of Pay, based on the employee’s hourly wage rate, multiplied by 130 hours per month; and
  3. Federal Poverty Line, based on the individual federal poverty level as of six months prior to the beginning of the plan year, divided by 12…

The reduction in the affordability percentage may likely mean that employers will have to reduce what employees pay for self-only coverage in order to maintain compliance, depending on what safe-harbor the employer uses.

Employers must be sure to carefully consider the safe harbors available and calculation of the lowest-cost employee coverage that should be charged.


Elizabeth H. Latchana, Attorney Fraser TrebilcockElizabeth H. Latchana specializes in employee health and welfare benefits. Recognized for her outstanding legal work, in both 2019 and 2015, Beth was selected as “Lawyer of the Year” in Lansing for Employee Benefits (ERISA) Law by Best Lawyers, and in 2017 as one of the Top 30 “Women in the Law” by Michigan Lawyers Weekly. Contact her for more information on this reminder or other matters at 517.377.0826 or elatchana@fraserlawfirm.com.

Client Alert: New Final HIPAA Regulations Released

Health plans, their sponsors, associated employers, and business associates have a lot of HIPAA work to do (including major updates to current documents) over the next several months. On January 25, 2013,
pursuant in part to the statutory framework of the HITECH Act, the Department of Health and Human
Services (“HHS”) published long-awaited final regulations modifying HIPAA’s privacy, security, enforcement, and breach notification rules.

The final regulations reflect both HITECH Act amendments and other comprehensive refinements to the current HIPAA rules. Indeed, HHS officials describe these new regulations as making “the most sweeping changes to the HIPAA Privacy and Security Rules since they were first implemented.” Specifically, the final regulations, among other things, enhance an individual’s privacy protections, strengthen the government’s ability to enforce the law, impose additional obligations on business associates (and their subcontractors), and require updates to a health plan’s HIPAA documents.

Highlights of changes include (but are not limited to) the following:

  1. Business Associates. The final regulations clarify the provisions in the Privacy and Security Rules that are directly applicable to business associates, and that direct liability applies to business associates that fail to comply with these provisions. Subcontractors of business associates will also now be directly obligated to comply with HIPAA, and business associates must enter into agreements with subcontractors in accordance with the requirements for business associate agreements. The final regulations also explicitly expand the definition of business associate and provide an agent/principal analysis to be used in determining whether liability of the business associate attaches to the covered entity . Business associate agreements will need to be updated to reflect the changes set forth in the final regulations (although under certain circumstances, a special transition rule may apply to a valid business associate agreement in effect before January 25, 2013 ).
  2. Changes to the breach notification requirements. The final regulations expand the definition of “breach.” The final regulations replace the original “risk of harm threshold” with a more objective standard. Specifically, the final regulations modify the definition of “breach” and the risk assessment approach that was set forth in the interim final rule. Under the new definition of breach, an impermissible use or disclosure of PHI is presumed to be a breach unless the covered entity or business associate, as applicable, demonstrates that there is a low probability that the PHI has been com promised. This standard replaces the “significant risk of harm” standard. The final regulations also modify the factors that covered entities and business associates must consider when performing a risk assessment with respect to a potential breach.
  3. Increased and tiered civil monetary penalties for noncompliance. Pursuant to the HITECH Act, the final regulations adopt higher penalties for HIPAA violations. Penalties, which range from $100 per violation to $50,000 per violation, are based on violation category (ranging from “did not know” to “willful neglect—not corrected) and the facts and circumstances surrounding the violation. The manner in which HHS counts violations may result in multi-million-dollar penalties.
  4. Restrictions on use of genetic information (pursuant to GINA). The final regulations expressly incorporate “genetic information” into the definition of PHI and generally prohibits the use or disclosure of genetic information for underwriting purposes to health plans that are covered entities.
  5. Expanded individual rights. The final regulations perm it covered entities to disclose a decedent’s PHI to family members and others who were involved in the care or payment for care of the decedent prior to death, unless doing so would be inconsistent with any known preference of the individual. The final regulations implement the HITECH Act requirement that covered entities, in certain circumstances, com ply with an individual’s request to restrict disclosure of his or her PHI. The final regulations also strengthen an individual’s right to access his or her PHI (including the right to receive electronic copies of PHI).
  6. Notice of privacy practices. The final regulations make significant changes to the content of a covered entity’s notice of privacy practices including (but not limited to) statements (1) regarding uses and disclosures that require authorizations, (2) related to fundraising communications, and (3) regarding an affected individual’s right to be notified following a breach of unsecured PHI. Thus, a covered entity is required to revise and redistribute its notice of privacy practices.
  7. Additional limitations. The final regulations impose additional limitations on how information is used and disclosed for marketing and fundraising purposes. The final regulations also prohibit the sale of an individual’s health information without their permission. Additionally, patients are permitted to restrict insurance companies from accessing portions of their medical records if they paid for the corresponding treatment out of their own pocket.
  8. Authorizations for research purposes disclosures and uses. The final regulations amend requirements for authorizations related to research. As such, authorizations for this purpose will need to be revised and updated.

These are just a few highlights of provisions found in the 560+ pages of the final regulations. The effective date for the final regulations is March 26, 2013, with a compliance deadline for most of the rules of September 23, 2013.

Health plans and their business associates need to begin preparing for the necessary changes now. The final regulations require health plans to update their policies and procedures, business associate agreements, and notices of privacy practices. Additional workforce training will also be necessary to update workforce members with access to PHI on the new regulations. HHS, even prior to the publication of the new final regulations, has aggressively investigated and enforced the HIPAA requirements. As such, it is as important as ever to ensure your health plan is HIPAA compliant.

For more information on compliance obligations under the new regulations, please reach out to your Fraser Trebilcock attorney

HIPAA Audits of Covered Entities: Including Medical/Dental/Vision/Health FSA/HRA/Wellness/EAP Plans

The Department of Health and Human Services (HHS) through its Office for Civil Rights (OCR) has begun a pilot audit program aimed at covered entities (and soon, business associates) regarding compliance with the HIPAA privacy / security / breach notification requirements.

Continue reading HIPAA Audits of Covered Entities: Including Medical/Dental/Vision/Health FSA/HRA/Wellness/EAP Plans

Health Care Mandate – UNCONSTITUTIONAL!

This afternoon, a three judge panel of the 11th Circuit Court of Appeals ruled 2-1 that the so-called “individual mandate” (the Obama health care reform law’s requirement that virtually all Americans purchase health insurance or face penalties) is unconstitutional.  The decision in Florida et al v. Dept. of Health & Human Services et al, a suit brought by 26 states, marks the first time that a judge appointed by a democrat has voted to strike down the mandate.  The panel ruled that the individual mandate portion of the law exceeds Congress’ power under the commerce clause by “mandating that individuals enter into contracts with private insurance companies for the purchase of an expensive product from the time they are born until the time they die.”  However, the appellate court did not go as far as the district court that originally heard the case, which found the entire health care overhaul to be unconstitutional.

Continue reading Health Care Mandate – UNCONSTITUTIONAL!