HIPAA and flexible spending accounts

Excerpted from Washington, D.C. Employment Law Letter,
written by attorneys at the law firm Krukowski & Costello, S.C.

The federal Health Insurance Portability and Accountability Act of 1996 (HIPAA) has rather complex privacy rules that many employers must follow. Those rules govern the use and disclosure of employees' "protected health information" (PHI). The rules are now in effect, except for employers with "small health plans" (i.e., those with receipts of $5 million or less), which have until April 14, 2004, to comply.

Employers that sponsor fully insured group health plans and receive no PHI from the plan are largely unaffected by the rules. But even if you're in that category, you should check to make sure you don't have any obligations under HIPAA. For example, if you provide a medical flexible spending account (FSA) as an employee benefit, as many employers do, you may be subject to the privacy rule.

FSAs offer employees an opportunity to have the employer withhold pretax dollars to be used by the employee for certain health care expenses not covered by insurance. The employer pays this withheld money back to the employee as medical expenses are incurred.

An FSA plan typically works as follows: At the start of the year, the employer asks employees to decide how much they want withheld from their income (up to a specified maximum) to be set aside in their FSA account. The employer typically prorates the withholding so it can take the same amount out of each paycheck in the course of the year. When an employee incurs uninsured medical expenses, she then presents appropriate documentation to the employer, which then reimburses her.

FSAs have become quite popular with employers and employees. For employers, they provide the opportunity to offer a benefit at virtually no cost. For employees, they provide a means of reducing income subject to taxes.

FSAs are considered self-insured group health plans. Accordingly, the HIPAA privacy rules apply, and the FSA plan document must be amended to identify which employees may receive PHI and for what purpose. Moreover, if you administer the FSA internally or receive PHI from a third-party administrator, the plan must comply with HIPAA's privacy rules. Note, however, that if the FSA is self-funded, self-administered, and covers fewer than 50 participants, it isn't subject to any of the HIPAA rules. Thus, many small employers' FSAs won't be covered.

For employers that provide FSAs covered by the HIPAA rules, we suggest that the following measures be taken:

• Consider outsourcing the administration of the FSA.
• If you continue to administer the FSA internally, consider making sure that staff members responsible for making employment decisions don't have access to PHI.
• Ensure that the plan documents the limited role that the employer plays in the administration of the plan and its lack of access or limited access to PHI.

Copyright 2003 M. Lee Smith Publishers LLC. This article is an excerpt from WASHINGTON, D.C. EMPLOYMENT LAW LETTER. WASHINGTON, D.C. EMPLOYMENT LAW LETTER does not attempt to offer solutions to individual problems but rather seeks to provide information about current developments in Washington, D.C. law. It is provided as a means of conveying accurate, but general, information. It is not intended as legal advice, which must always be tailored to individual needs and particular circumstances. Questions about individual problems should be addressed to the attorney of your choice.

• More HIPAA articles. If you subscribe to your state's Employment Law Letter, you can find many more articles about HIPAA in the subscribers area of HRhero.com. Click here to log in, then click on "HR Answer Engine."