HIPAA Compliance Requirements for State Employee Health Benefits Programs

State employee health benefits programs may involve a health plan, a state agency acting as plan sponsor, insurers, and service providers. Their responsibilities differ: a state employer is not automatically a HIPAA covered entity just because it offers benefits, but a qualifying group health plan may be one.

Which state employee health plans are covered entities under HIPAA?

HIPAA generally applies to a group health plan that provides medical care to employees or their dependents and has at least 50 participants, or is administered by an entity other than the employer that established and maintains it. That definition can cover insured and self-funded plans. A plan with fewer than 50 participants that is administered solely by its employer is generally excluded from the HIPAA covered entity definition. Check the plan’s size and administration arrangement rather than assuming every state employee benefit is covered. See HHS guidance on small health plans and the CMS overview of non-Federal governmental plans.

The state or agency acting as employer is not, by that fact alone, a HIPAA covered entity. The group health plan and a health insurer may be covered entities in their respective roles, while a third-party administrator or other contractor may be a business associate if it performs covered functions involving protected health information (PHI). A covered entity must use an appropriate written business associate arrangement when one is required. HHS explains which entities must comply with HIPAA.

For a fully insured plan, the insurer generally provides the privacy notice to members. A fully insured group plan that receives no PHI beyond summary health information and enrollment or disenrollment information is not required to maintain or provide its own notice under the Privacy Rule. Other limited obligations may still apply. See HHS guidance on fully insured group health plans.

How must plans protect members’ protected health information?

A covered plan must limit the use and disclosure of PHI to purposes permitted by the Privacy Rule, such as payment and health care operations, or to disclosures otherwise authorized or required by law. Where the minimum necessary standard applies, the plan should limit access and disclosure to what is reasonably needed for the purpose. Its protected health information safeguards should address how information is accessed, used, shared, and disposed of.

For electronic protected health information (ePHI), the Security Rule requires administrative, physical, and technical safeguards that reasonably and appropriately protect its confidentiality, integrity, and availability. That includes assessing security risks and managing them, controlling access, maintaining appropriate audit controls, responding to security incidents, and using measures to protect ePHI in transit. The rules are risk-based; they do not prescribe one identical technology setup for every plan. Review the requirements in 45 CFR § 164.308, § 164.310, and § 164.312.

Plans should also put suitable written agreements in place with business associates, train relevant workforce members, and maintain privacy and security policies. A vendor’s claim that it is “HIPAA compliant” does not replace the plan’s own duties or its need to assess risks and oversee how PHI is handled.

What safeguards must plan sponsors include in plan documents?

If a group health plan allows its sponsor to receive PHI for plan-administration functions, the plan documents must restrict how the sponsor may use and disclose that information. The documents must also require adequate separation between employees who perform plan-administration functions and those who do not. The sponsor must agree not to use or disclose PHI for employment-related actions or other purposes the Privacy Rule does not permit. See 45 CFR § 164.504(f).

The sponsor’s written commitments generally include implementing appropriate safeguards for ePHI, ensuring separation is supported by reasonable security measures, requiring agents and subcontractors receiving the information to protect it, and reporting unauthorized uses or disclosures and security incidents to the plan. The related Security Rule provisions appear in 45 CFR § 164.314(b).

HIPAA plan sponsor certification refers to the sponsor’s certification that it has amended the plan documents and agrees to the required restrictions and safeguards. It is not a government-issued certificate showing that the organization as a whole is HIPAA compliant. The special plan-document requirements do not apply in the same way when the sponsor receives only enrollment or disenrollment information or summary health information under the applicable exceptions. HHS describes plan sponsor PHI access and safeguards.

What privacy notices and member rights must plans provide?

A covered health plan must provide a HIPAA privacy notice explaining how it may use and disclose PHI, its privacy duties, and members’ rights. The notice must also describe how to submit a privacy complaint and identify a contact for questions. Plans generally provide the notice to new enrollees and remind current members that it is available, and how to obtain it, at least once every three years. If a notice changes materially, the plan must follow the applicable revision and distribution rules. See 45 CFR § 164.520.

Depending on the information held and the applicable rules, members may have rights to inspect or obtain copies of PHI in the plan’s designated record set, request corrections, request certain restrictions, ask for confidential communications, and receive an accounting of certain disclosures. These rights have specific limits and exceptions; for example, a plan does not have to agree to every requested restriction. Members can direct questions or requests to the contact listed in the plan’s notice. See the HHS overview of the Privacy Rule and individual rights.

How do HIPAA nondiscrimination and special enrollment rules apply?

Health factor nondiscrimination rules generally prohibit group health plans from basing eligibility, benefits, or premiums on an individual’s health status, medical condition, claims experience, receipt of care, medical history, genetic information, evidence of insurability, or disability. Certain health-contingent wellness programs may offer rewards only when they meet applicable safeguards, including reasonable alternatives for people who cannot meet a standard because of a health factor. See CMS guidance on health factor nondiscrimination and wellness programs.

Eligible employees and dependents who lose Medicaid or CHIP coverage may generally request group-plan special enrollment within 60 days after the coverage loss. A 60-day request period also generally applies when an employee or dependent becomes eligible for Medicaid or CHIP premium assistance toward the group plan. Employees and dependents must meet the applicable eligibility conditions. See the CMS Medicaid and CHIP special enrollment guidance.

Some self-funded non-Federal governmental plans have limited exceptions under the Public Health Service Act. Current rules generally prevent plans with plan years beginning on or after September 23, 2010, from opting out of the special enrollment and health-factor nondiscrimination requirements; certain older collective-bargaining elections may remain effective until the relevant agreement expires. Check the plan’s specific status and any applicable election using CMS’s list of self-funded governmental plan opt-out elections. These market-rule elections do not, by themselves, exempt a covered plan from HIPAA’s administrative simplification privacy and security requirements.

Which state insurance laws and additional privacy protections apply?

HIPAA is a federal baseline, not a substitute for checking the laws of the state where the plan operates. State privacy laws may provide stronger protections or additional individual rights, and a more stringent state privacy provision can prevail over a contrary HIPAA Privacy Rule provision. Where both laws apply without conflict, the plan may need to comply with both. See HHS guidance on more stringent state privacy laws.

Other state requirements may concern insurance policies, breach reporting, health-record confidentiality, or state-agency records. Which rules apply depends on factors such as whether coverage is insured or self-funded and how the state program is structured. Non-Federal governmental plans operate under a distinct federal framework for applicable Public Health Service Act requirements, with CMS enforcement; insured coverage may also involve requirements for the insurer. See CMS guidance on non-Federal governmental plans.

In short, determine whether each plan meets HIPAA’s covered-entity definition, identify who holds and administers PHI, document sponsor access and safeguards, provide required notices and rights, and confirm which state and federal coverage rules apply.

FAQs

Does HIPAA apply to every state employee health plan?

No. A state employee plan is generally covered if it meets HIPAA’s group health plan definition, which includes plans with at least 50 participants or plans administered by an entity other than the employer that established and maintains them. A plan with fewer than 50 participants administered solely by its employer is generally excluded. The state employer is not automatically a covered entity simply because it sponsors benefits.

What must a plan sponsor do to safeguard electronic protected health information?

If the sponsor receives ePHI for plan administration, the plan documents must require appropriate administrative, physical, and technical safeguards, adequate separation from employment functions, protections for information shared with agents or subcontractors, and reporting of security incidents to the plan. The sponsor must also comply with the plan-document restrictions on using and disclosing PHI.

How long do eligible employees or dependents have to request special enrollment after losing Medicaid or CHIP coverage?

They generally have 60 days after losing Medicaid or CHIP coverage to request enrollment in the group health plan, if they meet the applicable eligibility conditions. Certain legacy opt-out elections for some self-funded governmental plans may affect which rules apply, so check the plan’s current status.

Can state laws provide stronger privacy protections than HIPAA?

Yes. HIPAA generally does not preempt a contrary state privacy law that meets the federal definition of more stringent, and covered entities may have to comply with both state and federal requirements when they are not in conflict. State-specific legal review can identify additional protections and obligations.