HIPAA Privacy Compliance: It’s Time To Take It Seriously

The privacy rules under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) have been in effect for many covered entities since April 14, 2003. For small health plans, however, those with less than $5 million in annual claims or premiums, the deadline for compliance was April 14, 2004. As sponsors of these small health plans prepare to take steps to ensure compliance with the privacy rules, they can benefit from reviewing issues that have been confronted by sponsors of large health plans. This article discusses certain aspects of the HIPAA privacy rules that are likely to still cause confusion among sponsors of small health plans, based in large part on our conversations with sponsors of (and service providers to) these health plans.