Special Rules for Fully Insured Plans

The sponsor of a fully insured health plan has limited responsibilities with respect to the Privacy Notice, including the following:

• If the sponsor of a fully insured plan has access to PHI for plan administrative functions, they are required to maintain a Privacy Notice and provide the notice upon request; and
• If the sponsor of a fully insured plan does not have access to PHI for plan administrative functions, they are not required to maintain or provide a Privacy Notice. A plan sponsor’s access to enrollment information, summary health information and PHI that is released pursuant to a HIPAA authorization does not qualify as having access to PHI for plan administration purposes.

Plans and issuers must provide notice of participants’ rights to mastectomy-related benefits under the WHCRA at the time of enrollment and on an annual basis. The DOL’s compliance assistance guide includes model language for this disclosure.