Hippa Rules when plan admin & employer are the same

[Guest parrot87]

So if an employer is the plan administrator, how do they avoid Hippa compliance issues?

[J Simmons]

An entire treatise could likely be written on that.

Primarily the difference is that there would be no Business Associate agreement needed between the ER and a TPA, or monitoring of a TPA. The ER would yet need all the same 'internal' controls and limitations needed for whenever it possesses PHI, whether while using a TPA or the ER itself administering the plan. Due to the in-house administration, the employees with needed access to PHI to perform their job duties would likely be a larger number than if a TPA is used. However, the physical and IT issues and precautions ought to be just as rigorous for an ER that possesses any PHI while using a TPA as it is when not using a TPA.

If the ER is entirely administering the plan and has under 50 employees, the ER might qualify for an exception from HIPAA Privacy Rule, but yet need to comply with the HIPAA Security Standards.