As employers and their benefits advisors look toward open enrollment for their group health plans, now is a good time to review action items needed for those plans by year-end, as well as upcoming deadlines in the near future. While fully-insured health plans generally have their compliance obligations satisfied by the insurer, self-insured health plans usually rely on the employer or the plan's third-party administrator (TPA) to meet the compliance requirements. Below is a brief summary of items that employers and advisors should be aware of for their health plans and, as appropriate, we have delineated when such compliance is limited only to self-insured health plans.

1. HIPAA privacy extends special protections to reproductive healthcare: Employer action required by 12/23/24

Earlier this year, new regulations were issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that impose new restrictions on the use and disclosure of "protected health information" (PHI) that is classified as "reproductive health care." These changes require most group health plans to update their HIPAA policies and procedures and training practices by 12/23/2024 and their Notice of Privacy Practices by 2/16/ 2026.

The new regulations expand the prohibitions on the use or disclosure of PHI involving "reproductive health care" to include any of the following purposes: