Guest Article

(From the December 17, 2007 issue of Deloitte's Washington Bulletin, a periodic update of legal and regulatory developments relating to Employee Benefits.)

DOL Establishes an "Enforcement Safe Harbor" for Supplemental Health Insurance to Be Excepted from HIPAA Compliance

On a coordinated basis with the Departments of Treasury and of Health and Human Services, the Department of Labor recently established an "enforcement safe harbor" by which supplemental health insurance will be treated as excepted from certain HIPAA portability requirements if it meets a straightforward four-part test. Department of Labor Field Assistance Bulletin 2007-04 (December 7, 2007).

HIPAA Background

The Health Insurance Portability and Accountability Act ("HIPAA") imposes extensive portability, access and continuity requirements on group health plans and on health insurance issuers in the group and individual markets. Among other requirements, HIPAA imposes limitations on preexisting condition exclusions, requires certificates and disclosure of previous coverage, applies methods for counting creditable coverage, and imposes special enrollment periods. Under a notable carve-out, these requirements do not apply to a separate insurance policy, certificate, or contract of insurance, which provides only:

While the first two listed types of coverage are defined by statute, "similar supplemental coverage" is not defined in HIPAA or the regulations. The regulations provide only that the coverage must be specifically designed to fill gaps in primary coverage (such as coinsurance ordeductibles), and would not include coverage that becomes secondary or supplemental only under a coordination of benefits provision. 45 C.F.R. § 146.145(c)(5)(i)(C)

Citing this lack of guidance, and expressing concern that not all of the coverage being marketed as "similar supplemental coverage" actually qualifies for the exception, the Department established an "enforcement safe harbor." Coverage that meets the safe harbor will be considered "similar supplemental coverage" that is exempt from the relevant HIPAA requirements. Coverage that fails to satisfy the safe harbor may be subject to enforcement action.

Four-Part Safe Harbor Test

To satisfy the safe harbor and be exempt from the HIPAA requirements as "similar supplemental coverage," the health coverage must be issued under a separate policy, certificate, or contract of insurance, which is:

The information in this Washington Bulletin is general in nature only and not intended to provide advice or guidance for specific situations. If you have any questions or need additional information about articles appearing in this or previous versions of Washington Bulletin, please contact: Robert Davis 202.879.3094, Elizabeth Drigotas 202.879.4985, Mary Jones 202.378.5067, Stephen LaGarde 202.879-5608, Erinn Madden 202.572.7677, Bart Massey 202.220.2104, Mark Neilio 202.378.5046, Martha Priddy Patterson 202.879.5634, Tom Pevarnik 202.879.5314, Tom Veal 312.946.2595, Deborah Walker 202.879.4955. Copyright 2007, Deloitte.