HIPAA EDI compliance through business associate system

[Guest cjthornton]

My client is a self-insured group health plan and is very hands-on. They have contracted with an insurance company for a network and administrative services. This insurance company is EDI compliant and has told us that the plan sponsor/employer can "log on" to their system to send e-mails containing PHI about employee/participants (instead of the employer using its own e-mail system). Is this enough for the group health plan to be EDI complaint or must it have its own separate system that is EDI complaint?