HIPAA Gets Flexible: The HIPAA Compliance Deadline for Flexible Benefit Plans Is Approaching

Over the past year, employers have been assessing the impact of the privacy regulations issued under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") on the operations of their health plans. For many health plans, compliance with these regulations did not require significant efforts, and the initial deadline—April 14, 2003—passed without incident. Now, a new HIPAA deadline is approaching, and employers must consider the impact of the privacy regulations on a less-obvious health plan—the health flexible spending or medical reimbursement account ("FSA").

HIPAA’s initial compliance deadline affected "large" health plans (i.e., those with more than $5 million in annual claims payments or premiums), while the second deadline—April 14, 2004—affects most other health plans. Regardless of their size, the extent to which health plans must take affirmative steps to comply with HIPAA is determined mainly by how they are funded. When health plan benefits are paid on a