Covered entities (including any business that offers health benefits to employees) must implement policies, procedures, and notices to comply with the Health Insurance Portability and Accountability Act (HIPAA) regarding privacy, portability and other issues.

Our HIPAA compliance solutions are designed to help you meet your obligations under these complex laws.

COBRA refers to the Consolidated Omnibus Budget Reconciliation Act of 1985, specifically to its provision mandating that employees be offered voluntary, self-paid continuation of their health insurance after leaving the company.

Both HIPAA and COBRA were modified by the American Recovery and Reinvestment Act (ARRA) of 2009. Provisions both expanded and broadened the privacy protections of HIPAA, while a COBRA premium reductions (subsidy) was included for the federal government to subsidize 65 percent of COBRA payments through the end of 2009 for those "involuntarily terminated."

All businesses that offer health benefits to their employees must notify plan participants in writing of their rights under ERISA, COBRA, USERRA, and other applicable benefit plan laws. Failure to comply with benefit plan notice requirements can result in fines up to $110 per violation per day, or even disqualification of your health benefit plan.

HIPAA

Employers who offer health benefits to their employees must ensure compliance with various regulations (including revised final discrimination rules) under the Health Insurance Portability and Accountability Act (HIPAA). These compliance obligations include implementing policies, procedures, and notices as required under HIPAA privacy rules, recent security rules, and revised final discrimination rules. Failure to comply with HIPAA regulations can lead to penalties of $100 per violation per day up to a maximum of $25,000 in a calendar year.

HIPAA Discrimination Rules prohibit discrimination against individuals or beneficiaries based upon a health factor in group health coverage, plan eligibility, and rewards for wellness programs. Final revised discrimination rules took effect 1/1/2008 for all calendar year health plans.

HIPAA Privacy Rules require employer sponsors of group health plans to adopt policies and procedures to ensure the privacy of each individual's protected health information (PHI). Privacy rule obligations were expanded and clarified in recent years due to court decisions, legal interpretations, and directives on how state and federal privacy laws interact.

HIPAA Security Rules require employer sponsors of group health plans to maintain the confidentiality and integrity of electronic protected health information (EPHI). Small health plans had to comply by 4/21/06, but must perform a risk analysis at least annually to ensure full compliance.

COBRA

Employers with 20 or more employees are subject to the health care continuation provisions of Title X of the Consolidated Omnibus Budget Reconciliation Act. Using a system of fines and a potential excise tax, COBRA mandates that affected employers make their health plans available to employees, their spouses and dependents when the latter encounter certain “qualifying events” that otherwise would terminate their insurance coverage.

For employees, a qualifying event can be either voluntary and involuntary termination for reasons other than gross misconduct or a reduction in hours. For spouses, the same qualifying events make them eligible for continued coverage, but in addition, the covered spouse’s death or eligibility for Medicare becomes a qualifying event, as does divorce or legal separation. For dependents, all of the above apply, as does their loss of status as dependent children. In certain cases, different qualifying events can occur over time, affecting the length of coverage that can be offered, as explained next.

Once eligible for COBRA, an individual (called an AEI, or assistance eligible individual, in COBRAese) has 60 days in which to elect the continuation option, after which the coverage offer expires. In normal circumstances, continued coverage is available for 18 months, but if the person becomes disabled, the coverage can be extended 11 months for a total of 29 months. In cases of divorce, COBRA can run up to 36 months. However, coverage beyond the initial 18 months may be charged at 150 percent of the prevailing premium.