"In light of the December 31, 2014 deadline, it's important that plan sponsors finalize and document their use of [Early Retiree Reinsurance Program (ERRP)] funds if they have not done so already .... Plan sponsors that used a data aggregator, insurer, or other third-party administrator to collect or maintain data should ensure that they properly maintained those records and are in compliance with the HIPAA privacy provisions, including proper disposal when the records are no longer needed."