Employee Benefits Briefing

June 2002

NEW PRIVACY RULES AFFECT PLAN SPONSORS UNDER ERISA

The Department of Health and Human Services ("HHS") issued a regulation, "Standards for Privacy of Individually Identifiable Health Information," on December 28, 2000, pursuant to the privacy provisions of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). On March 27, 2002, HHS issued proposed modifications intended, in part, to further broaden and clarify the obligations of group health plans covered under HIPAA.

Most group health plans are required to comply with these regulations by April 14, 2003 (April 14, 2004 for small health plans with less than $5 million in receipts annually). While the privacy rule does not directly regulate employers in their role as plan sponsors, it does regulate group health plans sponsored by employers. The privacy rule, therefore, will have some effect on most employers that provide health care benefits to employees, and will impose substantial obligations on many employers and their health plans, particularly self-insured plans.

Who Is Covered Under the Rule?

The final regulation covers health plans, health care clearinghouses, and those health care providers who conduct certain financial and administrative transactions electronically (such as electronic billing and funds transfer). Covered entities are responsible for ensuring that protected health information is not misused or improperly disclosed. The final rules require covered entities to establish clear procedures to protect patients’ privacy, including designating an official to establish and monitor the entity’s privacy practices.

There has been significant confusion under the final rule as to the effects on employers that offer health benefits to their employees. The preamble to the final rule expressly clarifies that an employer is not a covered entity. Nonetheless, by covering "health plans," most employers who offer health benefits to employees under the Employee Retirement Income Security Act of 1974 ("ERISA"), whether insured or self-insured, will be covered by the regulation.

The most common category of plans or programs sponsored by private-sector employers that constitute "health plans" for purposes of the HIPAA privacy rules are "group health plans." A group health plan is any employee welfare benefit plan that is subject to ERISA and that provides medical care, but only if the plan (i) has 50 or more participants or (ii) is administered by any entity other than the employer that established and maintains the plan. Group health plans include medical plans, dental plans, prescription drug programs, mental health programs, vision plans, and health care flexible spending account plans. Health insurance issuers, health maintenance organizations (HMOs), Medicare Parts A and B, Medicare+Choice programs, and the issuers of long-term care policies (other than nursing home fixed-indemnity policies) are also "health plans" under the HIPAA privacy regulations. HHS makes clear in the final rule that its jurisdiction does not extend to a wide range of insurance entities that use and disclose health information, and therefore that the privacy rule does not apply to workers’ compensation, automobile, disability, or life insurance, even when such arrangements provide coverage for health care services.

What Is Protected Health Information?

Under the final regulation, protected health information ("PHI") includes all medical records and other individually identifiable health information held or disclosed by a covered entity in any form, whether communicated electronically, on paper, or orally.

What Are the Obligations of Plan Sponsors?

Under ERISA, a plan sponsor is any employer that sponsors or maintains a group health plan for its employees. A group health plan must meet virtually all of the same obligations as other health plans, unless the plan is fully insured and has very limited access to employee health information. In its basic coverage provisions, the privacy rule clarifies the distinction between group health plans and employer plan sponsors by creating a regulatory barrier that restricts the flow of protected health information between the group health plan and the employer plan sponsor without requiring the plan documents to be amended. If, however, the employer will use PHI in conjunction with administering the health plan, the plan documents must be amended to limit the exchange of PHI between the health plan and the employer. The primary goal is to prevent employers from using their employees’ protected health information in the course of making employment-related decisions.

Accordingly, the privacy rule has placed conditions on any exchange of PHI between a group health plan (and/or the insurer or other entity involved in administering or insuring the plan) and the plan sponsor. It is important that an employer understand the obligations imposed by the privacy rule—and consider whether it (a) can in fact implement these requirements or (b) would rather structure its health benefits program to minimize these obligations.

A plan sponsor’s obligations under the privacy rule will vary depending on whether it receives PHI, summary health information or no health information at all. If a plan sponsor determines that it can effectively manage its programs with summary health information and not PHI, it may be able to avoid many of the obligations imposed by the privacy rule. For example, a group health plan is not subject to the rule’s administrative requirements if it meets two criteria:

1. the plan provides benefits "solely" through an insurance contract with an insurer or HMO, and
2. the plan does not create or receive PHI, except for:

• "summary health information" or
• information on whether the individual is participating in the group health plan, or is enrolled in or has disenrolled from an insurer or HMO.

Summary health information consists of claims history, expenses or types of claims stripped of certain personal identifiers. A plan sponsor may receive summary health information if it agrees to limit its use of the information to obtaining premiums bids for providing health insurance coverage to group health plans or modifying, amending or terminating the group health plan. If the summary identifies participant information, the plan must inform the individual of the disclosure.

No self-insured group health plan can avoid the full set of administrative requirements imposed on other covered entities. Only fully insured plans can avoid these compliance obligations.

For a fully insured group health plan that receives no PHI, the obligations are fairly limited. The plan must:

• refrain from retaliating against those exercising their rights under the privacy rule; and
• refrain from requiring an individual to waive rights under the rule as a condition of receiving treatment, receiving payment, enrolling in a health plan, or being eligible for benefits.

The proposed regulations further clarify that group health plans may exchange enrollment and disenrollment information with the employer without amending the plan documents to incorporate certain privacy protections. This clarification will be good news for employers with fully insured plans that, under the current rules, already do not have to comply with certain administrative requirements because they do not create or receive detailed health information to administer their plans.

Otherwise, the group health plan must fully comply with the HIPAA privacy rule in the same way that a health insurer or hospital would need to comply. In addition to the limited obligations imposed on certain fully insured group health plans, plan sponsors must ensure that the group health plans maintained by them:

• designate a privacy official who is responsible for the development and implementation of a covered entity’s policies and procedures;
• designate a contact person (or office) that is responsible for receiving complaints filed under the privacy rule;
• establish policies and procedures concerning protected health information that are designed to comply with the rule;
• train all members of the appropriate workforce on the entity’s protected health information policies and procedures;
• establish appropriate administrative, technical, and physical safeguards to maintain the privacy of health information from intentional or unintentional use or disclosure that is in violation of the privacy rule;
• provide a process for individuals to make complaints concerning the covered entity’s policies and procedures, or its compliance with its policies and procedures, or the privacy regulation;
• establish and apply sanctions as appropriate against members of its workforce for violations of the covered entity’s policies and procedures, or the privacy regulation; and
• mitigate any harmful effect about which the covered entity has knowledge resulting from a known violation of its policies and procedures.

For those plan sponsors that require PHI, the final rule gives plan sponsors limited rights to receive and use protected information. It also significantly increases administrative and operational burdens. The plan sponsor must certify to the group health plan that the plan sponsor agrees to:

• prevent disclosure or use of any health information other than as specified in the plan document or required by law;
• ensure that any subcontractors or agents, including the health plan, to whom the sponsor provides health information also agree to the same restrictions;
• prevent disclosure or use of protected health information for employment-related actions;
• report to the group health plan any use or disclosure that is inconsistent with plan documents or the privacy rules;
• make the protected information available to individuals and allow them to amend their information;
• provide an accounting of disclosures;
• make its practices available to the HHS secretary for compliance review;
• return and destroy all health information when it is no longer needed, if feasible; and
• provide firewalls to identify employees (by name or by function) who will have access to the information, restrict access to the information only to those identified employees who have specific administrative functions, and provide a policy to resolve noncompliance issues.

What Penalties Exist Under the Privacy Rules?

HHS’s Office for Civil Rights ("OCR") is charged with enforcing the privacy regulations. OCR will provide information to covered entities to help them comply with the rules, answer questions and provide guidance, conduct compliance reviews, investigate complaints, seek monetary penalties, and refer cases for criminal prosecution. Covered entities that violate the standards may be fined $100 per incident, with limits of $25,000 per person per year for each standard violated. Criminal penalties may apply to covered entities that knowingly violate the standards, obtain information under false pretenses, or acquire information for financial gain, as follows:

• up to $50,000 and one year in prison for obtaining or disclosing protected health information;
• up to $100,000 and up to five years in prison for obtaining health information under false pretenses; and
• up to $250,000 and up to 10 years in prison for obtaining or disclosing health information with the intent to sell, transfer, or use it for commercial or personal gain or malicious harm.

Coordination with ERISA.

HHS has clarified that ERISA would preempt state laws establishing privacy rules to the extent that they relate to employee benefit plans. Therefore, ERISA-covered health plans can rely on HIPAA and its privacy regulation.

Although the privacy rule does not give individuals the right to sue covered entities, it does require certain group health plans to be amended, as mentioned above, to permit the exchange of PHI between the employer and the plan, subject to certain restrictions. Violating these restrictions could expose an employer to lawsuits under ERISA, because failing to operate the plan according to plan documents is a breach of fiduciary duty under ERISA.

In conclusion, employers that sponsor health plans should review their use of employee health information, and even consider restructuring their operation to minimize the impact of HIPAA’s privacy rules. If this is not practical, employers must begin to adopt procedures and review documents and agreements to comply with the privacy rules. Otherwise, improper use or disclosure of protected health information could result in exposure to employee lawsuits, even though the rules themselves do not create a private right to sue.

DEPARTMENT OF LABOR CHANGES VOLUNTARY CORRECTION PROGRAMS

The Department of Labor recently announced several positive changes to the Delinquent Filer Voluntary Compliance Program (the "Delinquent Filer Program") and the Voluntary Fiduciary Correction Program (the "Fiduciary Correction Program").

Delinquent Filer Voluntary Compliance Program

The Delinquent Filer Program was originally established by the Department of Labor’s Pension and Welfare Benefits Administration (the "PWBA") in April 1995. It was designed to encourage plan sponsors who missed the deadline for filing required annual reports (Form 5500s) to voluntarily file the delinquent reports and then benefit from reduced civil penalties. Although the original Program contained reduced penalties, many plan sponsors did not use the Program because even the reduced penalties could be onerous. The modifications announced on March 28, 2002, substantially reduce the penalties and provide other improvements.

The Internal Revenue Service issued a concurrent Notice announcing relief from any IRS penalties for plan sponsors who properly correct delinquent filings through use of the Delinquent Filer Program, including full payment of the DOL penalties. No separate filing with the IRS is required. Prior to this IRS Notice, plan sponsors making use of the Delinquent Filer Program left themselves open to substantial IRS penalties for late filings.

Under the old design, the per-day late filing fee for all plans was $50, with a cap of $2,000 for small plans (those with fewer than 100 participants at the beginning of the plan year) and $5,000 for large plans. Under the modified Delinquent Filer Program, the daily fee drops to $10 per day, with caps for a single late annual report of $750 for small plans and $2,000 for large plans.

In addition, the modified Program adds a new per-plan fee cap for corrective filings which address multiple delinquent annual reports. The per-plan cap is $1,500 for a small plan and $4,000 for a large plan, making the Program more economical for plans that have missed annual filings for more than one year. For top-hat plan filings, the cap is $750 regardless of the number of plans. For plans maintained by 501(c)(3) tax-exempt employers, the cap is $750 for each plan.

There is no per-sponsor cap, so the per-plan cap will apply to every plan (other than top-hat plans), even if the plans have the same sponsor.

In addition to the new fee structure, the modified Program makes several administrative changes. The plan administrator may now choose between the annual report form for the plan year for which relief is sought and the most current form available at the time the administrator elects to participate in the Program. With this option, the least burdensome form may be used. Prior to this change only the most current form could be used. Also, the forms and penalty payment no longer have to be identified in bold red print as a DFVC filing or payment.

Voluntary Fiduciary Correction Program

Under the Fiduciary Correction Program, which was established by the PWBA as an interim program in March 2000 and has now been adopted on a permanent basis, certain ERISA violations may be self-corrected without the risk that the DOL will bring civil actions or impose penalties. The types of violations to be corrected under the Program include: delinquent delivery of employee contributions to a trust; prohibited loans; and payment of excessive plan expenses. Full correction under the Fiduciary Correction Program entails correction of the violation, calculation of losses, full restoration of the losses with interest or profits, and, if applicable, distribution of supplemental benefits owed to participants and beneficiaries. If the steps are properly followed, the PWBA will issue a "no action" letter.

One major change in the permanent Fiduciary Correction Program involves elimination of required written notice to participants of correction under the Program. In addition, the modified Program allows for a de minimis exception, where corrections of less than $20 per individual are not required if the filer demonstrates that the cost of making the correction exceeds the value of the correction. Also, the Fiduciary Correction Program is now expanded to cover delinquent contributions to welfare plans.

In addition, the IRS will provide applicants under the Program with relief from IRS excise taxes associated with certain classes of transactions corrected under the Program. However, if filers elect such excise tax relief, they must satisfy certain notice requirements. The special circumstances under which a filer may elect out of the IRS excise tax include: (1) failure to timely transmit participant contributions to the trust, (2) the making of a loan at fair market interest rates to a party in interest to the plan, and (3) the purchase or sale of an asset at fair market value between a plan and a party in interest.

NEWS BRIEFS

IRS UPDATES SPECIAL TAX NOTICE

Prior to making an "eligible rollover distribution" (generally, any distribution other than annuity payments or minimum required distributions), a plan administrator is required to provide the recipient with certain information. The IRS has previously published a model "Special Tax Notice" which satisfied this notice requirement. As a result of the tax law changes made by the Economic Growth and Tax Relief Reconciliation Act of 2001 ("EGTRRA"), the prior version of the IRS Notice is no longer accurate in certain respects. The IRS has now released a new version of the Notice which should be used for all distributions after December 31, 2001. As before, the Notice can be edited to omit portions that are not applicable, such as the sections on after-tax contributions or employer securities. Please contact us if you would like an updated version of the Notice.

CALCULATING PENSION PLAN LUMP SUMS

The Internal Revenue Code requires the use of specific interest and mortality assumptions when determining the amount of a lump sum payment under a defined benefit pension plan.

The interest rate to be used in this calculation cannot be greater than the interest rate on 30-year Treasury Securities. The suspension of the sale of such securities by the Treasury Department last year and the suspension of the published 30-year Treasury Constant Maturity Rate earlier this year has created confusion on how to comply with the Code requirement. The IRS has now provided an interim solution until Congress can enact an amendment to the Code. In Notice 2002-26, the IRS announced that it will publish a monthly average of the daily yields on 30-year Treasuries maturing in February 2031, and that this rate may be used for calculating lump sums.

In Revenue Ruling 2001-62, the IRS announced an updated "applicable mortality table." This new table, based on a blend of 50 percent male/50 percent female mortality rates in the 1994 Group Annuity Reserving Table (94 GAR), must be used for distributions with annuity starting dates on or after December 31, 2002, and may be used for distributions during calendar year 2002. This table generally provides for longer life expectancies and therefore greater lump sum amounts. In addition to calculating lump sums, it must also be used in adjusting benefit limitations under Code Section 415(b)(2). A plan amendment reflecting this new mortality table must be adopted by the end of the plan year that contains the effective date.

EGTRRA GOOD FAITH AMENDMENT

The Economic Growth and Tax Relief Reconciliation Act of 2001 (EGTRRA) made a number of changes in the rules governing qualified retirement plans, including increasing the compensation and contribution limits, allowing "catch-up" contributions for employees age 50 or over, increasing vesting for matching contributions, and expanding rollover options, as more fully described in our Special Report dated July 16, 2001. These changes are generally effective for the 2002 plan year.

A plan amendment reflecting these changes must be adopted by the end of the 2002 plan year. The IRS has issued model "good faith" amendments that can be used for this purpose. If a good faith amendment is adopted this year, the plan sponsor can adopt a more detailed amendment (presumably after applicable regulations have been issued) as late as the end of the 2005 plan year.

Some plans were amended to include the new good faith amendment when restated for GUST. If your plan has not yet been amended for EGTRRA, please contact us for further assistance in understanding how EGTRRA affects your plan.

WEIGHT LOSS PROGRAM EXPENSES

The IRS has determined that the cost of weight loss programs are deductible as a medical expense, and therefore may be reimbursed under a health care flexible spending account.

Revenue Ruling 2002-19 deals with two specific situations. In the first situation, the individual was diagnosed by a physician as obese. In the second situation, the individual was directed by a physician to lose weight as treatment for hypertension. In both cases, the individuals incurred expenses for initial enrollment in a weight loss program, meeting fees and diet food items. The IRS found that obesity was a disease and that hypertension was a medical condition. Thus, the weight loss program expenses were deductible. However, the diet food expenses were not deductible since the diet food was a substitute for the food the individuals would normally consume. The ruling does not address other expenses such as health club dues or exercise equipment.

Plan sponsors who would like to allow reimbursement of weight loss program expenses should review their plan documents to determine if any revisions are necessary.

The Employee Benefits Briefing is published by the law firm of Vedder, Price, Kaufman & Kammholz. It is intended to keep our clients and interested parties generally informed on legal developments in Employee Benefits. It is not a substitute for professional advice.