Download a PDF of this piece
Employers need to keep HIPAA compliance at top of mind when
doing Internal Revenue Code §§ 6055 and 6056 reporting on
Forms 1095-C. Form 1095-C is used by employers to report offers of
minimum essential medical coverage to employees (Parts I and II of
the Form) and by employers that offer self-insured minimum
essential coverage to report employee enrollment in such coverage
(Part III of the Form).
An employer's medical plan is a covered entity subject to
HIPAA privacy, security and breach notification rules (HIPAA). If
the medical plan is insured, the insurance company is generally
responsible for compliance with HIPAA (provided the employer does
not receive any protected health information (PHI), except for
limited purposes). If the employer's medical plan is
self-insured, the plan itself – and not the employer –
is subject to HIPAA. Nevertheless, since the plan has no employees,
it must rely on those workforce members of the employer
