September 22, 2014 Deadline for Certain Business Associate Agreements

The Health Insurance Portability and Accountability Act ("HIPAA") requires a covered entity, including an employer-sponsored group health plan subject to HIPAA, to enter into a HIPAA-compliant business associate agreement with each of the covered entity's business associates (i.e., entities that perform services for the health plan and have access to protected health information).  In 2013, the Department of Health and Human Services ("HHS") issued final regulations modifying HIPAA. The regulations required HIPAA-covered entities to amend or restate their business associate agreements to reflect the new regulations. 

HHS has provided transition relief that delays the deadline to amend an existing business associate agreement by up to one year beyond the regulations' general operational compliance effective date of September 23, 2013, provided that (i) the agreement was effective prior to January 25, 2013 and compliant with the HIPAA rules that were in effect as of that date, and (ii) the agreement was not modified or renewed from March 26, 2013 through September 23, 2013. A business associate agreement that satisfies the above requirements is deemed compliant with the new regulations until the earlier of the date the agreement is renewed or modified, or September 22, 2014.  Employers that sponsor a group health plan subject to HIPAA should review their plan's business associate agreements to determine whether an amendment or restatement is needed prior to the September 22, 2014 deadline.  

November 5, 2014 Deadline for Registration for Health Plan Identifiers

HHS issued final regulations that will require self-insured employer-sponsored group health plans subject to HIPAA to use a unique health plan identifier code ("HPID") to identify themselves when conducting certain electronic transactions (e.g., electronic claims payment).  In addition, all other covered entities will be required to use the health plan's HPID when identifying the plan in such transactions.  Plans subject to this new requirement must register with HHS by November 5, 20141  to obtain an HPID.  Please click here to access the website HHS has established for this purpose.

After receiving an HPID, an employer should provide the HPID to the third party administrator of their health plan so that the third party administrator can use the HPID for electronic transactions that it processes for the plan.