As employers and their benefits advisors look toward open enrollment for their group health plans, now is a good time to review action items needed for those plans by year-end, as well as upcoming deadlines in the near future. While fully-insured health plans generally have their compliance obligations satisfied by the insurer, self-insured health plans usually rely on the employer or the plan's third-party administrator (TPA) to meet the compliance requirements. Below is a brief summary of items that employers and advisors should be aware of for their health plans and, as appropriate, we have delineated when such compliance is limited only to self-insured health plans.

1. HIPAA privacy extends special protections to reproductive healthcare: Employer action required by 12/23/24

Earlier this year, new regulations were issued under the Health Insurance Portability and Accountability Act of 1996 (HIPAA) that impose new restrictions on the use and disclosure of "protected health information" (PHI) that is classified as "reproductive health care." These changes require most group health plans to update their HIPAA policies and procedures and training practices by 12/23/2024 and their Notice of Privacy Practices by 2/16/ 2026.

The new regulations expand the prohibitions on the use or disclosure of PHI involving "reproductive health care" to include any of the following purposes:

• To conduct a civil, criminal, or administrative investigation into any person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care;  
• To impose liability on a person for the mere act of seeking, obtaining, providing, or facilitating reproductive health care; or  
• To identify any person described in the above two bullet points.

These prohibitions only apply if:

• The activity relates to a person seeking, obtaining, providing, or facilitating reproductive health care; and  
• The health plan or any of its business associates that receives a request for PHI reasonably determines that: |
  • the reproductive health care was lawful in the state where it was provided;
  • the reproductive health care was protected by federal law; or
  • the reproductive health care was presumed to be lawful.

The new regulations provide that reproductive health care is presumed to be lawful unless the health plan or business associate has actual knowledge it was unlawful or factual information that provides a substantial basis that it was unlawful. Therefore, it is likely the expanded prohibitions will apply in the majority of circumstances.