HIPAA and HRA's

[Guest ehs]

I understand that HRA's are subject to HIPAA, but I am not totally clear on the notice requirements. If the HRA is tied to a health plan, will the HIPAA notice that is sent under the health plan presumed to satisfy notice under the HRA? Are annual notices required?

[J Simmons]

An HRA may be an integral part of a broader, overarching health 'plan'. If so, then HIPAA compliance and notices by the plan of which the HRA is merely a part would do.

An HRA may also be a 'plan' separate and apart from another health plan with which the HRA was designed to work in tandem. If this is the case, then the HRA will have its own, separate HIPAA compliance and notice requirements and challenges.

How is this determined? Does the HRA have its own, separate documentation? Does it have a title separate and apart from merely being a provision for reimbursement included in the broader plan? Does the employer use a separate 3-digit number in identifying the HRA in distinguishing it from the broader plan? Is there a separate effective date? Are there separate 'plan administrators', 'named fiduciaries', agents for legal service?

This issue surfaced years ago in the context of cafeteria plans with flex accounts. Did the flex accounts amount to a 'plan' separate from the cafeteria plan itself, for purposes of Form 5500 filings?

You might want to get a legal opinion on whether your HRA constitutes a separate plan.

[Jacmo]

As I understand it, an HRA is a separate plan, regardless of how intertwined it may be with the connected health plan and would therefore be subject to most or all of the same requirements as the base health plan.