Compliance concerns related to the Health Insurance Portability and Accountability Act (HIPAA), the Genetic Information Nondiscrimination Act (GINA), Health Saving Accounts (HSA), and Essential Health Benefits (EHB) are some of the top issues for businesses due to the COVID-19 (coronavirus) outbreak. The Internal Revenue Service (IRS) and the Department of Health and Human Services (HHS) have already issued some helpful guidance, and more is likely to follow.
What information is protected under HIPAA?
HIPAA privacy rules require a high level of confidentiality for employer health plan information. Employers with self-insured health plans must have policies and processes to ensure this confidentiality. Where health information comes from determines whether the HIPAA privacy rule applies. For example, the information provided directly from an employee to an employer unrelated to medical insurance benefits is not protected health information (PHI). If an employee tells an employer that the employee has tested positive for coronavirus and is self-quarantining, HIPAA does not protect that information. However, if that information came from the self-funded group health plan or in a conversation about medical benefits under the employer’s plan, it would be PHI and HIPAA would apply.
One of the significant issues surrounding the coronavirus is how HIPAA applies to information about those infected. HIPAA protects the privacy of employee PHI but is balanced to ensure that appropriate uses and disclosures of PHI still may be made when necessary to treat a patient, to protect the nation’s public health, and for other critical purposes. The U.S. Department of Health and Human Services (HHS) has addressed some of these issues in a recent bulletin. The bulletin reminds those subject to HIPAA (i.e., self-funded group health plans, insurance companies and medical providers, and their vendors) that HIPAA still applies, even in emergencies.
The bulletin notes that HIPAA allows PHI to be disclosed without an individual’s authorization when disclosed to appropriate authorities engaged in public health activities. Examples of those authorities include the CDC and state and local health departments who collect information about the spread of the coronavirus, or to a person in a position to prevent or lessen a serious and imminent threat to the health and safety of an individual, or the public (consistent with other applicable laws and standards for ethical conduct). However, these provisions for disclosure are rarely applicable to health plans. Penalties for violation of HIPAA privacy rules are potentially large, so employers should consult counsel to be certain an exception applies before making any disclosure of health plan information.
What information can employers collect about an employee’s health?
GINA prohibits employers from using genetic information of employees in a discriminatory manner, both for purposes of health insurance and for any aspect of employment. Title II of GINA prohibits employers from requesting genetic information from employees. Employers cannot ask an employee about the manifestation of a disease or disorder in a family member of the employee, including an employee’s spouse. Therefore, GINA prohibits an employer from asking an employee whether a family member has tested positive for coronavirus or exhibited symptoms.
There is an exception for inadvertently acquiring this type of genetic information (i.e., the “water cooler problem”). For example, if an employer asks an employee a general question about an employee’s health and the employee volunteers’ information about family medical history, there is no violation of GINA. But the employer may not then ask follow-up questions that are probing in nature, such as whether other family members also have the condition. The employer should know that these questions are likely to result in the acquisition of genetic information.
Interestingly, the preamble to the final GINA regulations notes that employer groups urged the Equal Employment Opportunity Commission (EEOC) to only classify conditions that are ‘‘inheritable’’ as genetic information in family members. The groups argued that Congress did not intend that GINA applies to conditions such as the common cold or the flu. For three reasons, the EEOC decided not to make this change in the final rule.
- The language in the regulation is consistent with the plain language of the statute, which does not include the word ‘‘inheritable.’’
- Given the rapidly developing field of genetics, the EEOC believed that requiring its investigators and entities covered under Title II to determine whether a family member’s disease or disorder is ‘‘inheritable’’ or has a genetic basis would present significant compliance and enforcement problems.
- The EEOC doubted that questions about whether a family member has a cold, the flu, or similar conditions would often result in charges being filed under GINA.
Rule Changes to High Deductible Health Plans
Many employers offer high deductible health plans (HDHP) where HSAs provide funds for costs the employee must pay before the deductible is met. The HSA rules prohibit the HDHP from paying costs other than certain preventative care before the deductible is met. On March 11, 2020, the IRS issued Notice 2020-15, providing relief from this rule and allowing pre-deductible coverage for coronavirus related expenses.
The IRS stated that an HDHP that is otherwise eligible to have an HSA will not fail to be an HDHP merely because the health plan provides medical care services and items related to testing and treatment for the coronavirus purchased prior to the satisfaction of the applicable minimum deductible. As a result, the individuals covered by such a plan will not fail to be eligible individuals for HSAs merely because of the provision of those health benefits for coronavirus testing and treatment.
FAQs related to Essential Health Benefits
On March 12, 2020, HHS released a set of FAQs on essential health benefits and the coronavirus. Employer group health plans that are self-funded or in the large group market are not required to offer EHBs; however, if they do, they (i) cannot impose annual or lifetime limits on those benefits, and (ii) must apply the plan’s annual out-of-pocket maximum to them.
The FAQs state that the following are included in the definition of essential health benefits. These items affect a plan’s ability to apply annual or lifetime limits on such benefits. They also require such benefits to be considered for out-of-pocket maximums.
- Coverage for the diagnosis and treatment of coronavirus;
- Medically necessary isolation and quarantine required by and under the supervision of a medical provider during hospital admission (and maybe in the home, depending on the circumstances); and
- A coronavirus vaccine, when one becomes available, starting on the beginning of the plan year that is 12 months after the Advisory Committee on Immunization Practices recommends the new vaccine (or earlier if a plan chooses to cover the vaccine prior to that date).
There will be continuing developments from government agencies due to the evolving nature of this pandemic. We plan to provide regular updates on those developments.