What are the privacy obligations of a self-insured plan?
A. If the plan is self-insured, the employer as plan sponsor is responsible to see that HIPAA’s compliance burden is met. If the employer does not receive PHI from the plan, this means that the plan must issue a Privacy Notice, maintain written “policies and procedures” which are designed to ensure HIPAA compliance, and enter into Business Associate contracts where appropriate. The policies and procedures require that PHI may only be used or disclosed in accordance with HIPAA and require that individuals receive their HIPAA rights. If the employer receives PHI, the plan must comply with all of the HIPAA requirements discussed in Q and A 10 above. Of course, the employer as plan sponsor is responsible for this compliance.
