Excerpt: Subject to certain exceptions, below are the major steps that an employer will need to take in order to comply with the Privacy Rule with respect to use and disclosure of [protected health information] between the group health plan and the plan sponsor: ...