Are flexible spending accounts or cafeteria plans covered under HIPAA?
A “group health plan” is a covered entity under HIPAA, and must comply with all of the HIPAA regulations. A “group health plan” is defined as an “employee welfare benefit plan,” as that term is defined by the Employee Retirement Income Security Act (ERISA), to the extent that the plan provides medical care. See 42 USC ยง 1320d(5)(A) and 45 CFR 160.103. Thus, to the extent that a flexible spending account or a cafeteria plan meets the definition of an employee welfare benefit plan under ERISA and pays for medical care, it is a group health plan, unless it has fewer than 50 participants and is self-administered. Employee welfare benefit plans with fewer than 50 participants and that are self-administered are not group health plans. Flexible spending accounts and cafeteria plans are not excluded from the definition of “health plan” as excepted benefits.
