PHI Archives - EMPLOYEE BENEFITS BLOG

HHS Issues Guidance on Requirements Under HIPAA for Online Tracking Technologies, Addressing Privacy and Security Concerns Related to Health Information

by Jennifer S. Geetter, Elliot R. Golding, Amy C. Pimentel, Scott Weinstein, Edward G. Zacharias and Marine Margaryan | Dec 20, 2022 | Privacy and Data Security

On December 1, 2022, the Office for Civil Rights (OCR) at the US Department of Health and Human Services (HHS) issued a Bulletin on the obligations of covered entities and business associates (regulated entities) under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy, Security, and Breach Notification Rules (HIPAA Rules) when using online tracking technologies, such as cookies, web beacons and pixels. The Bulletin aims to provide further clarity on when identifiable information collected by such tracking technologies may also constitute protected health information (PHI) as defined and interpreted under the HIPAA Rules. In such instances, the Bulletin instructs that the technology vendor may be seen as providing a service to the regulated entity that would, in light of the use and disclosure of PHI, create a direct or downstream business associate relationship. Accordingly, the Bulletin states that the regulated entities would need to enter into a business associate agreement (BAA) with the vendor of the technology (and the vendor would, in turn, become a regulated entity) and meet other requirements under the HIPAA Rules. The Bulletin provides long-awaited guidance to help regulated entities review their positions and procedures concerning tracking technologies to ensure that the trackers they implement either do not collect PHI or meet the prerequisites outlined in the Bulletin.

Access the full article.

The Toughest Problem Set: Navigating Regulatory and Operational Challenges on University Campuses

by Jennifer S. Geetter, Laura Jehl and Michael Ryan | Sep 24, 2020 | Employment, Labor, Privacy and Data Security

Because widespread, rapid COVID-19 testing remains unavailable in many locations, universities have had to find innovative ways to implement testing, tracing and isolation protocols to reduce the risk of transmission among students, faculty and staff. There is no one perfect protocol—all universities are in unchartered waters. But there are a few key components university administrators may want to consider and address.

Access the article.

CARES Act Impacts All Benefit Plans

by Sarah L. Engle, Andrew Liazos, Erin Steele, Evan A. Belosa, Jacob Mattinson, Lindsay Ditlow, Lisa Loesel, Ralph E. DeJong and Samuel Everett Dewey | Mar 31, 2020 | Employee Benefits, Employment, Executive Compensation, Health and Welfare Plans, Retirement Plans

In the ongoing effort to help individuals impacted by COVID-19, Congress passed the Coronavirus Aid, Relief, and Economic Securities Act (CARES Act) on March 27, 2020. The President signed the CARES Act into law the same day. The historic stimulus package provides wide-ranging relief for both employers and employees. This includes rules that impact health and welfare, retirement and executive compensation plans and programs.

For more information about the impact of the CARES Act on employer-provided benefits, access our On the Subject articles on the:

In addition, for information about the frequently asked questions regarding health and welfare, retirement and executive compensation issues in the COVID-19 era, access our FAQs.

7 Tips to Avoid Compliance Missteps During Open Enrollment

by Jacob Mattinson and Megan Mardy | Nov 6, 2018 | Employee Benefits, Health and Welfare Plans, Privacy and Data Security

One of the busiest times of year for an employee benefits professional is open enrollment. It is a crucial and yet stressful time of year that typically results in numerous employee questions and complaints and is a time of year with high potential for both employer and employee mistakes. Despite the stress and potential for problems, open enrollment provides an opportunity for a company to set itself up for success for the following year.

The Employee Retirement Income Security Act (ERISA) does not require an annual opportunity for employees to change benefit plan elections. However, because of compliance issues that can spring from not offering a regular enrollment period, most companies choose to offer an “open enrollment” period, usually taking place in mid- to late fall for calendar-year health and welfare benefit plans.

Employee attention to employer communications during this period is often high, and attention to detail in participant communications behooves an employer during this period. Well-written and timely notices may be relied upon to satisfy many compliance obligations. Inaccurate or incomplete open enrollment materials, however, can create employee confusion and result in legal liability under the complex network of federal laws governing employer-sponsored benefit programs.

Read the full article here for a sampling of key issues to consider to help you avoid compliance missteps during this year’s open enrollment period.

Originally published in BenefitsPRO.com, October 2018.

Guidance on Ransomware Attacks under HIPAA and State Data Breach Notification Laws

by Anthony A. Bongiorno and Michael G. Morgan | Jan 12, 2017 | Health and Welfare Plans, Privacy and Data Security

The US Department of Health and Human Services has recently issued guidance under the Health Insurance Portability and Accountability Act on what covered entities and business associates can do to prevent and recover from ransomware attacks; however, other state data breach notification laws can also be triggered by a ransomware attack. The authors of this article explain the guidance and what to do if you are subject to a ransomware attack.

Read the full article here.

HIPAA Privacy and Security Compliance for Group Health Plan Sponsors

by McDermott Will & Emery | Aug 18, 2016 | Health and Welfare Plans, Privacy and Data Security

Joanna Kerpen authored an article on final HIPAA rules for privacy enforcement and audit programs, particularly those with additional requirements aimed at group health plan sponsors. This report focuses on the final regulations issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), in January 2013, HIPAA enforcement and audit programs, HIPAA-related additional requirements of group health plan sponsors, and the actions that must be taken by group health plan sponsors to ensure compliance with the final regulations and requirements and to prepare for potential audits and enforcement actions.

“The final HIPAA regulations made many changes to the existing HIPAA privacy and security rules that are applicable to covered entities,” Ms. Kerpen wrote, and she urged plan sponsors to conduct a comprehensive review of their compliance plans to prepare for audits or enforcement action.

Read the full article here.

OCR Launches Phase 2 HIPAA Audit Program with Pre-Audit Screening Surveys

by Edward G. Zacharias, Daniel F. Gottlieb and Ryan S. Higgins | May 26, 2015 | Health and Welfare Plans, Privacy and Data Security

HIPAA covered entities have reported that the HHS Office for Civil Rights recently sent pre-audit screening surveys to a pool of covered entities that may be selected for the previously delayed second phase of HIPAA compliance audits. This On the Subject describes the phase two audit program and identifies steps that covered entities and business associates should take to prepare for these audits.

Read the full article.