HIPAA's Self-Administered Plan Exception

[Chaz]

HIPAA exempts from the Privacy Rule a plan with fewer than 50 participants that is self-administered by its employer-sponsor.

An employer with fewer than 50 employees self-administers its health FSA. It is looking at moving the health FSA records to an off-site warehouse location. Assume that all ERISA and Code record retention requirements are met. Will the use of the third-party warehouse cause the plan to cease to be "self-administered" for purposes of the Privacy Rule's exception?

[J Simmons]

HIPAA exempts from the Privacy Rule a plan with fewer than 50 participants that is self-administered by its employer-sponsor.

An employer with fewer than 50 employees self-administers its health FSA. It is looking at moving the health FSA records to an off-site warehouse location. Assume that all ERISA and Code record retention requirements are met. Will the use of the third-party warehouse cause the plan to cease to be "self-administered" for purposes of the Privacy Rule's exception?

Is the third-party warehouse responsible to the ER for making sure that "all ERISA and Code record retention requirements" are met, or is the ER merely leasing regular storage space that the ER has vetted as suitable for the record retention requirements and the ER is itself making sure that all the record retention requirements are met?

[Chaz]

I believe that the employer intends that the warehouse store the records but retrieve them (and presumably necessarily have access to the content, some of which would otherwise be PHI) to deliver to the employer in the event that the content is needed for ERISA/Code (really, more likely for ERISA) purposes. The agreement between the employer and the third party would bind the third party to comply with ERISA and the Code as far as the record retention requirements. The records may be stored electronically.

The scenario is worrisome to me.

[J Simmons]

I believe that the employer intends that the warehouse store the records but retrieve them (and presumably necessarily have access to the content, some of which would otherwise be PHI) to deliver to the employer in the event that the content is needed for ERISA/Code (really, more likely for ERISA) purposes. The agreement between the employer and the third party would bind the third party to comply with ERISA and the Code as far as the record retention requirements. The records may be stored electronically.

The scenario is worrisome to me.

Me too.