Privacy Notice Reminder

(Benefits Update, No. 2, May 2009)

Group health plans that were required to comply with privacy requirements of the Health Insurance Portability and Accountability Act (HIPAA) by April 14, 2003 (i.e., large health plans) now have an obligation to notify individuals who are covered by the plan that the privacy notice is available, and to tell them how to obtain the notice. This reminder notice must be sent at least once every three years.

For most large plans (defined as $5 million in claims for self-insured plans, and $5 million in premiums for fully-insured plans) the reminder notice must be sent by April 14, 2009. The notice can be hand-delivered or sent via U.S. mail to the named insured or covered employee. The reminder notice can be sent via email only if the named insured or covered employee has agreed to receive the notice electronically.

Group health plans who have been providing an updated notice each year as part of the open enrollment materials will not have to provide a new Privacy Notice to those who already receive it as part of the enrollment package.