When HR professionals think about the Health Insurance Portability and Accountability Act (HIPAA), privacy and the protection of health information may be the first things that come to mind. However, HIPAA also includes important nondiscrimination protections that affect employer-sponsored group health plans.
What is HIPAA?
HIPAA was signed into law on August 21, 1996. While many people associate HIPAA with medical privacy, the act also established protections related to health coverage portability, nondiscrimination and the security of certain health information. As electronic health care transactions became more common, HIPAA established national standards governing the use and disclosure of protected health information (PHI), as well as administrative, physical and technical safeguards to help protect that information.
The Health Information Technology for Economic and Clinical Health (HITECH) Act later strengthened HIPAA’s privacy and security requirements, expanded breach notification obligations and made many business associates of covered entities directly responsible for complying with certain HIPAA requirements.
An important distinction for employers is that an employer, acting solely in its capacity as an employer, generally is not a HIPAA-covered entity. However, most employer-sponsored group health plans are subject to HIPAA requirements to some degree. As a result, employers that sponsor group health plans often have HIPAA compliance responsibilities related to the administration of those plans.
For HR professionals, complying with HIPAA extends beyond simply protecting employee health information. It also requires understanding how a group health plan determines eligibility, structures premiums and contributions, administers benefits and handles protected health information in accordance with HIPAA’s privacy, security and nondiscrimination requirements. Understanding these obligations can help employers administer their health plans appropriately while reducing compliance risk.
What are the HIPAA nondiscrimination rules?
HIPAA generally prohibits a group health plan or health insurance issuer from discriminating against an individual with regard to eligibility, benefits or individual premiums or contributions based on a health factor. HIPAA identifies eight of these health factors:
- Health status
- Medical condition (both physical and mental illnesses)
- Claims experience
- Receipt of health care
- Medical history
- Genetic information
- Evidence of insurability
- Disability
In practice, HIPAA’s nondiscrimination rule means that a health plan generally cannot deny an employee eligibility for coverage or charge an employee more than another similarly situated individual due to the employee’s health status, disability, medical history or another protected health factor.
What are similarly situated individuals?
HIPAA’s nondiscrimination rules generally apply within groups of similarly situated individuals. A group health plan cannot treat individuals within the same similarly situated group differently based on a health factor. However, certain individuals may be treated as distinct groups of similarly situated individuals for the purpose of HIPAA nondiscrimination rules if the distinction is based on a bona fide employment-based classification.
Depending on the circumstances, permissible classifications for similarly situated individuals may include:
- Full-time versus part-time employees
- Different occupations
- Dates of hire
- Geographic locations
- Membership in a collective bargaining unit
- Length of service
- Current versus former employee status
This distinction is important. A health plan may be able to establish different eligibility or contribution rules based on a legitimate employment classification.
GINA and HIPAA Nondiscrimination Rules
The Genetic Information Nondiscrimination Act of 2008 (GINA) expanded protections involving genetic information. Under GINA, group health plans generally may not adjust premiums or contribution amounts for a plan or a group of similarly situated individuals based on genetic information. Health plans also generally may not request or require an individual or family member to undergo a genetic test or request, require or purchase genetic information before or in connection with benefit enrollment or for insurance underwriting purposes.
There are limited exceptions to this. For example, if genetic information is needed to determine the medical appropriateness of an item or service for payment purposes, a plan may request the minimum amount of genetic information necessary to make that determination.
Certain requests made for research purposes may also be permitted, provided that specific regulatory requirements are satisfied. The restrictions established under GINA are particularly important because genetic information could include family medical history, not just the results of a genetic test.
HIPAA Nondiscrimination Rules and Wellness Programs
Wellness programs present another area where HIPAA’s nondiscrimination requirements can come into play. HIPAA generally divides wellness programs into two categories: participatory programs and health-contingent programs.
A participatory wellness program either does not provide a reward or does not require an individual to satisfy a health-related standard to receive a reward. Examples could include programs that reimburse the cost of a fitness center membership or provide a reward for completing a health education program (without requiring participants to achieve a specific health outcome). Participatory programs generally must be available to all similarly situated individuals.
Health-contingent wellness programs, on the other hand, require individuals to satisfy a standard related to a health factor in order to receive a reward. In general, health-contingent wellness programs must:
- Give eligible individuals the opportunity to qualify for the reward at least once per year.
- Be reasonably designed to promote health or prevent disease.
- Make the full reward available to all similarly situated individuals, including by providing a reasonable alternative standard or waiver when required.
- Disclose the availability of a reasonable alternative or the possibility of a waiver in plan materials that describe the terms of the wellness program.
- Keep the reward within applicable limits.
Under HIPAA, the maximum reward may not exceed 30 percent of the total cost of the applicable coverage. The limit increases to 50 percent for programs that are designed to prevent or reduce tobacco use. Other federal laws may also apply to wellness programs, so employers should work with their benefits advisor when creating or modifying an employee wellness program.
Actively at Work Provisions
Eligibility provisions requiring an employee to be “actively at work” could raise HIPAA nondiscrimination concerns when they are tied to a health factor. Generally, a group health plan cannot deny or delay an employee’s eligibility, benefits or coverage effective date because the employee is absent from work due to an illness or other health factor.
For example, if a new employee’s coverage is scheduled to begin on May 1 but they are absent that day because of an illness, the plan generally cannot delay coverage solely because of that health-related absence. However, a neutral eligibility rule that requires all new employees to begin coverage on the first day they actually report to work, regardless of the reason for the absence, is generally permissible.
HR professionals should review eligibility provisions with their benefits advisor to help determine whether they apply consistently or could result in less favorable treatment based on an individual’s health status.
More Favorable Treatment of Individuals
HIPAA’s nondiscrimination rules are designed to protect individuals from adverse treatment based on health factors. However, they do not necessarily prohibit a plan from treating someone with an adverse health factor more favorably. Providing more favorable eligibility rules in these circumstances is not prohibited by HIPAA’s nondiscrimination requirements.
For example, let’s say that an employer offers a group health plan that provides benefits for eligible employees, their spouses and dependents. Dependents are eligible for coverage until they reach age 26. However, dependent children with a disability are eligible for coverage beyond the age of 26. In this case, extending coverage for dependent children with disabilities is permitted since it provides more favorable treatment based on a health factor.
Make Compliance Part of Your Benefits Strategy
For HR professionals, HIPAA nondiscrimination rules are an important part of group health plan administration. Regularly reviewing plan provisions, administrative practices and employee communications can help employers identify potential issues and better understand their responsibilities.
Higginbotham’s employee benefits professionals work with employers to help them navigate an evolving benefits landscape and develop employee benefits strategies aligned with their workforce and organizational goals. Connect with one of our benefits consultants today to learn more.
