hipaa privacy policy in a fully insured plan

[TPApril]

Trying to understand at what point a wrapped plan becomes a a 'group health plan' subject to hipaa privacy rules to the extent that the plan needs to adopt a formal privacy policy. If there is such a need to what extent do plan administrators develop such a policy and hand out notices (annually?) to employees?

[TPApril]

any thoughts?

[GMK]

For what it's worth, we have wrap document for our welfare plan and a privacy policy for the protected health information we may receive (which isn't much).

We post the privacy policy on the bulletin boards and summarize it in the handbook.