Under the HIPAA privacy rules, employers who sponsor self-insured health benefits (such as medical plans, flexible spending accounts, health reimbursement accounts, etc.) have an obligation at least once every three years to remind participants in the plan that a Notice of Privacy Practices is available. Depending upon your first compliance date, you may now be coming up on this deadline.
If your company sponsors a large health plan (one with annual claims and/or premiums of $5 million or more), you had an initial compliance deadline of April 14, 2003. As part of your compliance obligation, you delivered to each participant a Notice of Privacy Practices. If you have not sent this notice to your participants since then, you must now remind them that the Notice is available.
According to guidance issued by the Department of Health and Human Services, you can fulfill this notice requirement in a number of ways, such as:
sending a copy of your Notice of Privacy Practices to each of your participants;
mailing a reminder that the Notice is available with information on how to obtain a copy; or
including a reminder and details of how to obtain a copy in your health plan's newsletter or other publication.
To satisfy the requirement, you need to deliver the reminder to only each employee, retiree, or COBRA participant covered by your plan. You do not need to deliver a separate copy to dependents. You can deliver the notice through an internal mail delivery system or by U.S. mail. If you have permission from the participant, you may deliver the notice by e-mail.
You do not have to send out a reminder if you have sent a Notice of Privacy Practices to your participants more recently than three years ago. For example, if you substantially amended your Notice of Privacy Practices recently, you probably sent the Notice to your participants at the time of amendment, in which case a reminder at this time is unnecessary. If you (or your TPA or insurance issuer) routinely send out the Notice of Privacy Practices on an annual basis, you also do not need to send the reminder.
If your company sponsors a small health plan (one with annual claims and/or premiums of less than $5 million), you will have until April 14, 2007, to comply with the reminder requirement.
If you have any questions about this reminder requirement, please contact Norbert Kugele of Warner Norcross & Judd LLP at 616.752.2186.