Scope of Health Plan Definition under HIPAA

Discussion

The Health Insurance Portability and Accountability Act of 1996, (“HIPAA”), P.L. 104-91, and its implementing regulations, 45 CFR Part 160 et seq., apply to “covered entities.” A covered entity under HIPAA is a health plan, health care clearinghouse, or health care provider who transmits any health information in electronic form in connection with a transaction within the scope of HIPAA. 45 CFR § 160.103. These transactions generally are health claims and insurance information.

The question has arisen whether certain DHHS agencies fall within the definition of “health plan” for this purpose. Specific examples include the Division of Aging, the Division of Vocational Rehabilitation, and the Division of Services for the Blind. Each of these agencies administer programs that pay providers for a variety of services to clients, including some services that would be characterized as health services.

Bill Cox July 9, 2001 Page 2

Although HIPAA was enacted in 1996, the first two sets of implementing regulations have only recently become effective, with implementation dates scheduled in October, 2002 and April, 2003. Other regulations are expected, along with additional policy guidance from the federal Department of Health and Human Services. This opinion, therefore, is based on the present statute, regulations and accompanying materials. It is possible that future regulations or policy pronouncements could alter the conclusions stated below.

The term “health plan” is defined by statute at 42 U.S.C. § 1320d to include 13 categories of entities. Examples include commercial health insurance carriers and the Medicaid and Medicare programs.

The first “final” regulations to be adopted by the Secretary of the US Department of Health and Human Services were the Standards for Electronic Transactions (“EDI”), which became effective October 16, 2000. The EDI regulations included definitions adopted as 45 CFR §

160.103. 65 Fed. Reg. 50,366 (Aug. 17, 2000). These expanded the statutory definition of health plan by adding State child health plans and making additional “clarifications.” The regulatory definition of “health plan” included the phrase: “when applied to government funded programs, the components of the government agency administering the program.”

Four months later, the regulatory definition of “health plan” was changed by the next set of regulations to become final: Standards for Privacy of Individually Identifiable Health Information (“Privacy Regulations”), effective April 14, 2001. The Privacy Regulations included a revised 45 CFR 160.103. The definition of “health plan” was changed in at least two significant ways. First, the language regarding government funded programs was deleted from the opening paragraph. Second, the following entities were specifically excluded from the definition:

A government-funded program (other than one listed [in the enumeration of included

entities]):

(A) whose principal purpose is other than providing, or paying the cost of, health care; or

(B) whose principal activity is:

(1)

The direct provision of health care to persons; or

(2)

the making of grants to fund the direct provision of health care to persons.

65 Fed. Reg. 82,799-800 (Dec. 28, 2000).

The comments to the Privacy Regulations are fairly explicit about the intent of these changes:

[M]any commenters were confused by the statutory inclusion as a health plan of any “other individual or group plan that provides or pays the cost of medical care;” they questioned how the provision applied to many government programs. We therefore clarify that while many government programs (other than the programs specified in the statute) provide or pay the cost of medical care, we do not Bill Cox July 9, 2001 Page 3

consider them to be individual or group plans and therefore, do not consider them to be health plans. Government funded programs that do not have as their principal purpose the provision of, or payment for, the cost of health care but which do incidentally provide such services are not health plans (for example, programs such as the Special Supplemental Nutrition Program for Women, Infants and Children (WIC) and the Food Stamp Program, which provide or pay for nutritional services, are not considered to be health plans). Government funded programs that have as their principal purpose the provision of health care, either directly or by grant, are also not considered to be health plans. Examples include the Ryan White Comprehensive AIDS Resources Emergency Act, government funded health centers and immunization programs. We note that some of these may meet the rule’s definition of health care provider.

65 Fed. Reg. 82,479 (Dec. 28, 2000)(emphasis added).

The following government-funded programs, therefore, are excluded from the definition of “health plan” under the current regulations:

1. Programs whose principal purpose is other than providing health care.

2. Programs whose principal activity is the direct provision of health care to persons.

3. Programs whose principal purpose is other than paying the cost of health care.

4. Programs whose principal activity is making grants to fund the direct provision of health care to persons.

This appears to leave as possible “health plans” only those government-funded programs whose principal purpose and activity is paying for the cost of health care on some basis other than grants, but which do not directly provide health care to persons.

Under this criteria, the Divisions of Aging, Services for the Blind, and Vocational Rehabilitation fall outside the definition of “health plan,” because their principal purpose is other than providing health care or paying the cost of health care. Each of these units have duties established by statute that show that payment of health care costs is only an incidental function at best. See G.S. § 143B-181.1 (Aging); G.S. § 111, Articles 1, 2 (Services for the Blind); G.S. § 143