ICHRA Administrator HIPAA Compliance Checklist for Owners

What HIPAA requirements apply to ICHRA administration?

An ICHRA is a type of account-based group health plan. HIPAA applies to a group health plan that meets the definition of a covered entity, but there is an exception for a plan with fewer than 50 participants that is administered solely by the employer that established and maintains it. A plan with an outside administrator generally does not qualify for that exception, even if it has fewer than 50 participants. See HHS guidance on small health plans and the HIPAA definitions in 45 CFR § 160.103.

HIPAA generally regulates the group health plan and its business associates, not the employer in its role as employer. If you sponsor an ICHRA, keep plan administration separate from employment decisions. If the plan permits you to access PHI for plan administration, its documents must address permitted uses, restrictions, and separation between plan-administration and employment functions. HHS explains plan-sponsor access and separation requirements.

Use this checklist to establish the right scope:

• Determine whether the ICHRA is a covered entity or qualifies for the small, solely employer-administered plan exception.
• Identify which employees and vendors perform plan-administration work and whether they handle PHI.
• Document permitted uses, workforce access, safeguards, and incident reporting responsibilities.
• Keep PHI out of hiring, discipline, performance reviews, and other employment decisions.

Which ICHRA records may contain protected health information?

Records can contain protected health information when they identify a participant and relate to their health care, health-care payment, or enrollment in the plan, and are held by the covered plan or a business associate. ICHRA files that may contain PHI include reimbursement requests, receipts, invoices, explanations of benefits, prescription records, claim decisions, and correspondence that describes a person’s treatment or medical expenses.

Coverage documents may also contain identifiable information. An insurance card or enrollment confirmation can show that a person has coverage without revealing a diagnosis; avoid collecting extra fields or documents when the plan can verify eligibility with less information. Employment records held by an employer in its employer role are generally treated differently from plan records held on the plan’s behalf. HHS summarizes the Privacy Rule’s scope and safeguards.

Classify and store records by purpose. Keep enrollment verification and reimbursement substantiation in the plan’s restricted administration system—not in general personnel files—and avoid retaining medical details that are not needed to decide eligibility or a claim.

How should owners limit access to PHI?

Apply the minimum necessary standard: for uses and disclosures it covers, limit PHI to what is reasonably needed for the task. HIPAA does not apply this standard to every situation, including disclosures made under an individual’s valid authorization. HHS guidance explains the standard and its exceptions.

Set access by role. For example, a benefits administrator may need eligibility or claim-status information, while a manager making workplace decisions should not receive claim details. Use unique user accounts, limit administrator permissions, review access when duties change, and periodically remove access that is no longer needed. The plan sponsor’s access to PHI for plan administration is subject to the plan-document and separation requirements described by HHS.

• Define which roles may view enrollment, reimbursement, and claim records.
• Give each user only the access needed for assigned plan duties.
• Keep plan-administration records separate from employment files and systems where practical.
• Train authorized staff on confidentiality, permitted uses, and how to report suspected incidents.

When are HIPAA authorizations and business associate agreements required?

A business associate agreement (BAA) is generally required when an outside vendor performs plan functions involving PHI on behalf of a covered plan—for example, claims processing, reimbursement administration, or hosting PHI as the plan’s service provider. The BAA should define permitted uses, require safeguards and incident reporting, address subcontractors, and provide for return or destruction of PHI when the relationship ends, when feasible. See HHS’s business associate guidance and sample BAA provisions from HHS.

Whether a vendor is a business associate depends on what it does and whether it creates, receives, maintains, or transmits PHI on behalf of the plan—not simply on the vendor’s label. A vendor that handles no PHI generally does not need a BAA for that service. Ask administrators and technology providers to describe the data they handle, their subcontractors, and the roles each party performs.

A HIPAA authorization is generally needed for a use or disclosure of PHI that the Privacy Rule does not otherwise permit or require. It must meet HIPAA’s requirements, including identifying the information, discloser, recipient, purpose, and expiration. An authorization is not a general substitute for a BAA when a vendor is acting as the plan’s business associate. HHS explains when an authorization is required and what it must contain.

How can owners verify coverage while minimizing health data access?

ICHRA rules require reasonable procedures to substantiate individual coverage, including annual confirmation of coverage and substantiation for the month tied to a reimbursement. IRS guidance describes using a participant attestation or third-party documentation for coverage substantiation. A coverage confirmation can typically focus on the participant, covered dependent, coverage dates, and insurer or plan name, rather than diagnoses or treatment details. See the IRS’s ICHRA substantiation guidance and model attestations.

For each verification, define what evidence is acceptable and who reviews it. Use the least detailed reliable evidence that satisfies the plan’s substantiation procedures. Keep coverage verification separate from medical-expense claims review, and do not request full medical records merely to confirm that individual coverage is in force.

An employer may receive information needed for plan administration only through a HIPAA-permitted route, and plan-sponsor access to PHI is subject to applicable plan-document restrictions. Ask the administrator to provide a coverage-confirmation result or other limited information when that is sufficient; do not use health information for employment decisions.

What plan documents and claims procedures should be maintained?

Maintain current plan documents and procedures that explain eligibility, permitted expenses, substantiation requirements, reimbursement limits, claim submission, decision notices, and review or appeal steps. Make sure the administrator’s workflow follows the written plan terms and that staff know how to route a claim or privacy request.

For private-sector plans subject to ERISA, benefit claims procedures must meet applicable standards for processing claims, issuing denial notices, and reviewing appeals. The Department of Labor describes these requirements in its group health and disability plan claims-procedure guidance. Confirm which requirements apply to your plan rather than assuming every plan has the same obligations.

Keep privacy and security policies, workforce training records, BAAs, plan-sponsor certifications, access assignments, and incident records as required documentation. HIPAA requires covered entities to retain documentation required by the Privacy Rule for six years from its creation or last effective date, whichever is later. HHS summarizes HIPAA’s documentation-retention rule.

How should ICHRA records be secured and retained?

For electronic PHI, the HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards. Build a risk-based program that addresses access control, user authentication, audit activity, device and media handling, incident response, backups, and secure transmission. HHS describes the Security Rule’s safeguard requirements.

For paper files, restrict access to locked storage and use secure disposal when records are no longer needed. For electronic records, promptly revoke access when a user leaves or changes roles, maintain appropriate access logs, and securely dispose of data in accordance with the plan’s retention and disposal procedures.

HIPAA does not set a general retention period for medical records or all PHI. It does require protection for PHI for as long as it is maintained, including during disposal; state law and other plan-related requirements may set additional retention periods. See HHS guidance on medical-record retention.

In practice, keep only the ICHRA records needed to administer the plan, limit access to authorized roles, use BAAs where required, document claims and privacy processes, and protect records throughout their retention and disposal.

FAQs.

Does HIPAA apply to every ICHRA employer?

No. HIPAA generally applies to the group health plan and its business associates, not to an employer in its role as employer. A plan with fewer than 50 participants that is administered solely by the employer that established and maintains it is excluded from the HIPAA covered-entity definition. A plan administered by an outside entity generally does not qualify for that exception. See HHS guidance on small health plans.

When does an ICHRA administrator need a business associate agreement?

When the administrator is a separate person or organization that handles PHI on behalf of a covered ICHRA plan to perform plan functions such as reimbursement or claims administration, the plan generally needs a BAA with that business associate. The agreement should cover permitted uses, safeguards, reporting, subcontractors, and handling PHI when the relationship ends. See HHS’s business associate guidance.

Can an employer review an employee’s medical information to verify ICHRA coverage?

Do not collect or review medical details if limited coverage documentation or an attestation will satisfy the plan’s substantiation procedures. If an employer receives PHI as plan sponsor, access must be permitted under HIPAA and any applicable plan-document restrictions; it must not be used for employment decisions. The IRS ICHRA guidance describes coverage-substantiation methods, and HHS explains plan-sponsor limits.

Does a HIPAA authorization replace safeguards for PHI?

No. A valid authorization permits a specified use or disclosure within its scope; it does not remove the obligation to protect PHI or replace a BAA when one is required. HIPAA’s minimum necessary standard does not apply to disclosures made pursuant to an authorization, but other applicable privacy and security obligations remain. See HHS guidance on the minimum necessary standard and the HIPAA Security Rule.