FAQs Archive

Q: Is a flexible spending account or a cafeteria plan a covered entity for purposes of the Privacy Rule and the other HIPAA, Title II, Administrative Simplification standards?

A "group health plan" is a covered entity under the Privacy Rule and the other HIPAA, Title II, Administrative Simplification standards. A "group health plan" is defined as an "employee welfare benefit plan," as that term is defined by the Employee Retirement Income Security Act (ERISA), to the extent that the plan provides medical care. See 42 USC § 1320d(5)(A) (DOJ) and 45 CFR 160.103 (GPO). Thus, to the extent that a flexible spending account or a cafeteria plan meets the definition of an employee welfare benefit plan under ERISA and pays for medical care, it is a group health plan, unless it has fewer than 50 participants and is self-administered. Employee welfare benefit plans with fewer than 50 participants and that are self-administered are not group health plans. Flexible spending accounts and cafeteria plans are not excluded from the definition of "health plan" as excepted benefits. See 45 CFR 160.103 (GPO), paragraph (2)(i) of the definition of "health plan."

Q: Is an entity that is acting as a third party administrator to a group health plan a covered entity?

No, providing services to or acting on behalf of a health plan does not transform a third party administrator (TPA) into a covered entity. Generally, a TPA of a group health plan would be acting as a business associate of the group health plan. Of course, the TPA may meet the definition of a covered entity based on its other activities (such as by providing group health insurance). See 45 CFR 160.103 (GPO).

Q: Are the following types of insurance covered under HIPAA: long/short term disability; workers' compensation; automobile liability that includes coverage for medical payments?

No, the listed types of policies are not health plans. The HIPAA Administrative Simplification regulations specifically exclude from the definition of a “health plan” any policy, plan, or program to the extent that it provides, or pays for the cost of, excepted benefits, which are listed in section 2791(c)(1) of the Public Health Service Act, 42 U.S.C. 300gg-91(c)(1). See 45 CFR 160.103 . As described in the statute, excepted benefits are one or more (or any combination thereof) of the following policies, plans or programs: Coverage only for accident, or disability income insurance, or any combination thereof Coverage issued as a supplement to liability insurance Liability insurance, including general liability insurance and automobile liability insurance Workers’ compensation or similar insurance Automobile medical payment insurance Credit-only insurance Coverage for on-site medical clinics Other similar insurance coverage, specified in regulations, under which benefits for medical care are secondary or incidental to other insurance benefits.