Home | Business News | Browse by Publication | M | Mondaq Business Briefing

HSAs and the HIPAA Privacy Rules: The Clash of the Acronyms.

Article Excerpt
Since December 2003 when President Bush signed the Medicare Prescription Drug, Improvement and Modernization Act of 2003, many articles in the popular and legal press have reviewed the benefits and features of Health Savings Accounts ("HSAs"). Structured similarly to Archer Medical Savings Accounts, HSAs offer an impressive list of attractive features, including no use-it-or-lose-it, the ability to use the funds for non-medical purposes, self-substantiation of expenses, and the list goes on. (The features of HSAs are discussed in more detail in our prior Legal Alert of February 2004 at

www.kilpatrickstockton.com/publications/legal_alerts.aspx

.) The focus of this legal alert will be on an issue that has received little discussion--the impact of the HIPAA privacy rules on the operation and design of HSAs.

The Two Components of an HSA Design

Individuals enrolled in high-deductible health plans ("HDHPs") may establish HSAs to receive tax-favored contributions. Thus, an HSA design will have two components--the first component will be the HDHP and the second component will be the HSA. The HDHP may be sponsored by an employer, or it may be offered by an insurer. Either way the HDHP will be subject to the HIPAA privacy rules. However, the analysis of whether an HSA is also covered by the HIPAA privacy rules should not turn on the status of the HDHP under HIPAA. While every person who has an HSA will also have an HDHP, there is no requirement under the Code or ERISA that these two components be linked in any manner. In fact, the entities that provide the HDHP (e.g., employers and insurers) will in most situations not be the entities that will be providing an HSA (e.g., banks and trust companies). From this perspective, therefore, the HIPAA privacy status of HDHPs should not taint or affect the HIPAA privacy status of HSAs.

Is an HSA a "Health Plan" under the HIPAA Privacy Rules?

If an HSA satisfies the definition of a "health plan" under the HIPAA privacy rules, then the HSA is considered a "covered entity" and would need to comply with the applicable HIPAA privacy rules.

Definition of a "Health Plan." The definition of a "health plan" includes seventeen different arrangements and types of coverages. Of these seventeen arrangements and coverages, only two appear to be applicable to HSAs: (1) ERISA group health plans, and (2) any individual or group plan that pays for the cost of medical care. Both of these arrangements are discussed below.

ERISA Group Health...