HIPAA Security Implementation Deadline Looms for "Small Health Plans"

In addition to the privacy rules, the Health Insurance Portability and Accountability Act ("HIPAA") imposes rules for maintaining the security of protected health information that is kept in electronic format. The deadline for "small health plans" (including medical, dental, vision and health flexible spending account plans) to comply with the security rules is April 21, 2006. "Small health plans" for HIPAA purposes are those that paid premiums or claims of $5 million or less in the most recent plan year. (The compliance deadline for larger health plans was April 21, 2005.)

The HIPAA security rules apply only to electronic protected health information, which includes information stored in or received or sent by a computer, and phone voice response and faxback systems. The security rules require covered health plans to implement administrative, physical and technical safeguards in order to protect any such electronic information.

Note that plans with fewer than 50 participants are exempt from the HIPAA security rules altogether, unless such a plan is administered by an entity other than the employer that established it. Plans that qualify for this exemption do not need to take steps to comply with the HIPAA security rules, whether they are "small" plans or "large" plans.

Further, although the HIPAA security rules technically cover both insured and self-funded health plans, sponsors of insured plans generally have minimal responsibilities under the rules.

Small self-funded health plans must generally take the same steps towards HIPAA security compliance as larger plans took last year.