Must VEBA plans be amended for HIPAA and provide the Privacy Notice?

[katieinny]

An employer has a medical expense reimbursement VEBA that is funded with only employer dollars pursuant to a collective bargaining agreement. It is not the actual health plan, but only a funding vehicle so that participants can be reimbursed for any out-of-pocket medical expenses.

I'm wondering if this plan must be updated for the HIPAA privacy regulations since claims and medical receipts are submitted that probably include personal information.

Also, since this is only a funding arrangement, does it need to have any language included that addresses COBRA or FMLA?

[Ron Snyder]

The DOL believes so. They have published compliance assistance for group health plans at http://www.dol.gov/ebsa/publications/top15tips.html. The VEBA itself is not a health plan but the medical expense reimbursements are. And there's more than COBRA and FMLA to address. Like HIPAA, MHPA the Newborns’ Act and the WHCRA. Many of those will not need to be addressed in the plan documents, but in the SPD and the administrative procedures, especially with respect to providing notices to terminating employees.

[Steve72]

VEBAGuru:

I think she's asking specifically about HIPAA Privacy.

Is there an actual health plan attached to the VEBA? That is the entity/document that would need amending.

[g8r]

Based on the initial question, the VEBA is a health plan b/c it's reimbursing medical expenses. Thus, HIPAA privacy would apply.

[katieinny]

There is no health plan attached to the VEBA. It was set up strictly to reimburse participants for out-of-pocket medical expenses, no matter what the source (e.g., eyeglasses, prescriptions, dental, co-pays, etc.). So, I'm thinking that FMLA, COBRA and the other acts mentioned don't apply to this reimbursement plan. I will tell the employer that it must be amended for HIPAA -- today!

But, just in case, I would like your thoughts on whether the other acts might also apply to this plan.

[Moe Howard]

katie, sounds to me like you've got a small self-administered medical plan.

Small = less than 50 participants.

If so, then your plan is not required to follow any of the HIPPA privacy rules.