Does HIPAA apply to a POP?

[J Simmons]

If an ER's only health plan is a POP (premium only plan; no flex accounts) to pay for health insurance premiums, does HIPAA privacy/security apply if EEs submit the applications (with health history info) directly to the insurance agent and the ER is not provided with individual claims information from the health insurer, even as part of annual renewal?

Would the ER need HIPAA policies, notices, business associate agreements, etc. even in the absence of it having any health info on its EEs?

[QDROphile]

A POP is a section 125 concept and it is not a group health plan. The group health plan that is funded through the POP must comply with HIPAA whether or not the administration of the POP or the health plan is expected to involve any handling of protected information by the employer.

[Guest LMPett]

Agree with QDRO but will add that if the health plan is fully-insured, the insurer is the covered entity with HIPAA responsibilities, not the plan sponsor (the employer).

The plan sponsor has very limited HIPAA responsibilities when plan is fully-insured and not receiving PHI (e.g, can't retaliate against an employee exercising his HIPAA rights).