As the Coronavirus (COVID-19) outbreak started impacting the United States, the U.S. Department of Health and Human Services (HHS) issued a stern reminder to all employers, especially those involved in providing healthcare, that they must still comply with the protections contained in the HIPAA Privacy Rule. In this regard, the Privacy Rule includes provisions that are directly applicable to the current circumstances.
Privacy Rule Background
The HIPAA Privacy Rule establishes detailed requirements to ensure the continued confidentiality, integrity, and availability of protected health information (PHI). HIPAA governs only covered entities (i.e., health plans, health care clearing houses, and health providers who conduct covered electronic transactions) and their Business Associates. Business Associates are those entities that handle or have access to PHI to perform certain functions on behalf of covered entities.
Covered entities and their business associates may not use or disclose PHI without written authorization from the patient or his or her personal representative, except when doing so for designated purposes or pursuant to specific exceptions. At its core, the Privacy Rule permits covered entities to use and disclose PHI, without a patient’s authorization, as necessary for treatment, care coordination, consultation and referrals of patients for treatment.
Information received by an employer from sources other than its health plan are most likely not PHI and use and disclosure would most likely be governed under other federal and state laws. The Privacy Rule does not protect your employment records, even if the information in those records is health-related. In most cases, the Privacy Rule does not apply to the actions of an employer. In such cases, employers should consult legal counsel regarding permissible uses and disclosure of employment records containing health information relating to COVID-19.
Application of HIPAA to COVID-19 in the Workplace
For employers who do receive PHI relating to COVID-19 through the group health plan or who are health care providers with access to PHI of employees, the information regarding COVID-19 status may be shared with public health authorities and others responsible for ensuring public health and safety if there is a legitimate need for the covered entity to share PHI with them to enable them to carry out their public health responsibilities. This may arise with the current outbreak COVID-19. The key, as always, is to limit disclosures to the minimum necessary to the purpose, strictly in accordance with these parameters and check with legal counsel prior to any disclosure.
As an example, covered entities may share information as necessary with the Centers for Disease Control and Prevention (CDC), as well as health departments authorized by law to receive such information, to prevent or control disease or injury. You may even disclose PHI to foreign government agencies that are working with authorized public health authorities.
Also, you may disclose information to individuals you believe are at risk of contracting or spreading the disease, if authorized for such purposes under other law. Information may be shared with family and others involved in a patient’s care as necessary to identify and locate individuals responsible for the patient’s care, location, or condition.
Next Steps
Employers who are providers should obtain verbal permission from the patient if possible, or if not possible, permission can reasonably be inferred. Consistent with other applicable law, covered entities may also disclose PHI as necessary to prevent or lessen a serious or imminent threat to a person or the public. It is important to remember, however, that in all cases, the minimum necessary standard is applicable to uses and disclosures of PHI, to authorized agencies or individuals.
Significantly, the Rule does not generally permit disclosure of PHI to the media or the public without the patient’s written authorization. As both the financial and practical costs of HIPAA violations can be steep, it is more than worthwhile for covered entities and their business associates to take this reminder from HHS very seriously. Thus, it is important to ensure compliance with these use and disclosure particulars of the Privacy Rule, even under challenging circumstances where it may cause a delay in disclosure.
This newsletter is brought to you by your Partner Firm of United Benefit Advisors – the nation’s leading independent employee benefits advisory organization with more than 200 Partner offices in the U.S., Canada, England, and Ireland – and Fisher Phillips. With 36 offices and attorneys practicing throughout the U.S., Fisher Phillips provides the resources to address every aspect of the employee/employer relationship. This newsletter is provided for informational purposes only. It is not intended as legal advice nor does it create an attorney/client relationship between Fisher Phillips LLP. and any readers or recipients. Readers should consult counsel of their own choosing to discuss how these matters relate to their individual circumstances. Reproduction in whole or in part is prohibited without the express written consent of Fisher Phillips. This newsletter may be considered attorney advertising in some states. Furthermore, prior results do not guarantee a similar outcome.
Applicable Large Employers (ALEs) Beware: IRS Says There is No Statute of Limitations for Assessing Employer Mandate Penalties
The concept of open-ended liability is contrary to the experience of taxpayers regarding most tax returns. Normally, when a taxpayer files a tax return, the filing of the return triggers the “statute of limitations” or period of time during which the IRS can challenge the information and liability reported on the return. In most cases, the statute of limitations for tax returns is three years from the date the return is filed. In the recent CCM, the IRS explains that the form filed by a taxpayer must meet certain criteria to be considered a “return” that, once filed, starts the statute of limitations running. In the CCM, the IRS concludes that the forms filed relating to the employer mandate do not qualify as “returns” that trigger the statute of limitations.
Background: Employer Mandate Penalties Under the ACA
Under the ACA, ALEs may be assessed penalties as follows:
⦁ 4980H(a): Failing to offer minimum essential coverage (MEC) to at least 95% of full-time employees and their dependents, if at least one full-time employee is certified for a month as having received a premium tax credit (PTC) on a health insurance exchange. This tax, currently set at $2,570 annually, is calculated by multiplying 1/12 of that amount times all full-time employees, minus the first 30, for any month in which an assessable full-time employee has a PTC. (The tax was $2,500 for 2019).
⦁ Offering MEC to at least 95% of full-time employees that is not affordable or does not provide minimum value, if one or more full-time employees is certified for a month as having received a PTC. This tax, currently set at $3,860 annually, is calculated by multiplying 1/12 of that amount times only the number of those assessable full-time employees who qualify for PTCs on the exchange for any month. (The annual tax was $3,750 for 2019). To determine whether HIPAA applies, you must consider (1) whether the information being requested will come from a Covered Entity or Business Associate, and (2) whether the request is seeking protected health information (PHI). If the request is for PHI from a Covered Entity or Business Associate, HIPAA will generally apply.
ALEs who are subject to the potential penalties must file Form 1094-C with the IRS and provide Form 1095-C to each full-time employee and the IRS outlining their overall compliance with the employer mandate and addressing the specific coverage, if any, provided to each full-time employee. In determining whether to assess employer mandate penalties, the IRS cross-references information reported by employers on IRS Forms 1094-C and 1095-C against information reported by individuals on their Forms 1040 and information received from the exchanges regarding PTCs.
Using this information, the IRS determines which full-time employees might have triggered a penalty based on the reported offer of coverage (or lack thereof), their employment status for the month, and, among other factors, the cost of coverage offered for the month. The IRS also receives reports from the exchanges (Form 1094-A Health Insurance Marketplace Statement) on advance payment of PTCs to individuals. By checking the employees’ Form 1040 returns, the IRS then determines, based on household income, which of those full-time employees were entitled to keep the PTCs. Once full-time employees with valid PTCs are identified, the IRS uses this information along with the information reported on Forms 1094-C and 1095-C to assess penalties, if applicable, to the ALE. The IRS notifies the ALE of its intention to assess ACA penalties via Letter 226-J, related forms, and subsequent correspondence.
IRS Determines No Statute of Limitations Applies for Employer Mandate Purposes
ALEs have taken the position that the Form 1094-C and attached employee statements (Form 1095-C) are returns that, when filed, trigger the three-year statute of limitations under Code Section 6501. The IRS disagrees on grounds that the data disclosed on Forms 1094-C and 1095-C is insufficient for it to calculate the tax liability. The CCM claims the forms only provide part of the information the IRS needs to calculate the tax, the rest of which is obtained from the exchanges, and from full-time employees’ tax returns. Disclosure of information that is sufficient to calculate tax liability is one of four criteria used to determine when a tax form, when filed, is sufficient to trigger the running of the statute of limitations. (See, Beard v. Commissioner, 82 Tax Court 766, 777 (1984), aff’d. 793 F.2d 139 (6th Cir. 1986)).
In this regard, the Forms 1094-C and 1095-C do not include information on employees’ eligibility for PTCs (which is required to calculate employer mandate penalties). Thus, at the time an employer files its Forms 1094-C and 1095-C, it will not know if:
⦁ Its full-time employees are PTC-eligible.
⦁ The employer has potential employer mandate liability.
In addition, the employer cannot calculate the amount of any penalty owed at the time it files Forms 1094-C and 1095-C. As a result, the IRS has concluded that an employer’s filing of Forms 1094-C and 1095-C is not sufficient to start the statute of limitations for assessing employer mandate penalties.
Employer Impact
The CCM is unfortunate news for employers who will not have the benefit of a definite limitations period regarding employer mandate penalties, which have been the subject of IRS enforcement efforts in recent years. Employers with issues on their prior forms should address with legal counsel whether corrections should be made now, even if that may mean the potential for additional penalties. Outstanding liabilities and questionable reporting could raise issues in corporate due diligence in the case of potential acquisitions or be a factor in IRS audits. At a minimum, employers will want to closely assess the accuracy of their current ACA compliance plan and reporting and ensure compliance moving forward.
This newsletter is brought to you by your Partner Firm of United Benefit Advisors – the nation’s leading independent employee benefits advisory organization with more than 200 Partner offices in the U.S., Canada, England, and Ireland – and Fisher Phillips. With 36 offices and attorneys practicing throughout the U.S., Fisher Phillips provides the resources to address every aspect of the employee/employer relationship. This newsletter is provided for informational purposes only. It is not intended as legal advice nor does it create an attorney/client relationship between Fisher Phillips LLP. and any readers or recipients. Readers should consult counsel of their own choosing to discuss how these matters relate to their individual circumstances. Reproduction in whole or in part is prohibited without the express written consent of Fisher Phillips. This newsletter may be considered attorney advertising in some states. Furthermore, prior results do not guarantee a similar outcome.
Benefits Considerations for Employers: COVID-19
Is COVID-19 testing covered by our group health plan?
It depends. If your plan is insured, you should contact your insurer to confirm coverage and cost-sharing parameters. As of early March 2020, insured plans in California, New York, Oregon and Washington must cover COVID-19 testing at no cost to members, and a growing number of states are implementing similar mandates. In addition, several major insurers have stated that for insured plans, doctor initiated/provided diagnostic COVID-19 testing will be provided at no cost. Note, the cost waivers applicable for testing do not extend to treatment activities.
Self-insured plans are not required to provide COVID-19 coverage but are under increasing pressure to do so. Plans that want to provide coverage should note that TPAs are actively encouraging and facilitating employer coverage of diagnostic testing for coronavirus and in at least one case, a large ASO is requiring its self-insured employer clients to “opt-out” of cost-sharing for coronavirus testing. Another item of particular note involves qualifying high deductible health plans (HDHPs) with health savings accounts (HSAs). Tax free contributions, by an employee or employer, to a HSA, are permitted only if: (1) an employee is enrolled in a HDHP that is prohibited from covering most services, other than “preventive care,” before the deductible is met and (2) an employee is not covered by any health plan that is not a HDHP. In an effort to facilitate COVID-19 efforts, the IRS issued Notice 2020-15, with specific guidance relating to HDHP qualification and HSA contribution deductibility. In Notice 2020-15, the IRS (1) clarified that vaccines are considered “preventive care” under Internal Revenue Code Section 223 and (2) provided that, until further notice, health benefits, medical services and items purchased in association with testing for or treatment of COVID-19, may be provided by a HDHP, without disqualifying the HDHP or covered individual from making HSA contributions. This latter provision essentially expands the preventive care exception to items and services purchased to test or treat this particular COVID-19 illness. Health plan language may impact what constitutes treatment and testing.
Employers should also keep an eye on proposed legislation. The “No Cost for COVID-19 Testing Act” if passed, would require insurers that sell group health care coverage under the ACA, including self-insured plans and grandfathered plans, to cover all COVID-19 testing without patient cost-sharing – including copays, coinsurance and deductibles. The Families First Coronavirus Response Act (H.R. 6201) was passed by the House on March 14, 2020, and is going to the Senate for consideration, includes requirements to provide coronavirus diagnostic testing at no cost to consumers.
How can we better leverage existing group health benefits for our employees?
Employers should consider enhanced promotion of its current benefit offerings to ensure employees take advantage of existing telemedicine, wellness program and low cost/subsidized healthcare services such as:
⦁ Telemedicine services. Telemedicine may be an ideal option for persons seeking medical consultation for mild-non-emergency care. If telemedicine services are offered as part of your group health plan, services may include coordination of diagnosis and treatment plans and or specialist referrals. Telemedicine services may be utilized from the comfort of an employee’s own home and may be a valuable option for persons who want to minimize external exposure.
⦁ Employee assistance programs. Employee assistance programs often provide great benefits that impact not only physical but mental health – stress management, elder care, personal finance, and substance abuse consultation are just some of the services commonly provided.
⦁ Wellness program services. Wellness programs are a rich resource of education relating to disease prevention. Many offer basic education on a variety of pertinent topics such as basic hygiene and traveling tips. Wellness programs often include nurse phone-line programs that can be utilized to obtain confidential responses to various health topics.
⦁ Disease management programs. Disease Management Programs are often tailored to employees and/or families at risk of developing chronic medical conditions like, high blood pressure or diabetes. Individuals in these programs may be more susceptible to COVID-19 so ensure they have opportunity to consult with their coach or case monitor as necessary to manage their health conditions.
⦁ Free or discounted preventive care. Flu shots and other vaccinations as well as diagnostic testing are often provided at no or low cost (via reductions or waivers in employee premiums, co-pays or deductibles) via a group health plan or wellness program.
In addition to what is currently available under your plan, plan sponsors may consider permitting the plan to cover a larger range of preventive care benefits. Last year, in Notice 2019-45, the IRS and HHS expanded the types of preventive care that will not interfere with HSAs for individuals diagnosed with asthma, heart disease and diabetes – individuals that are at a higher risk of getting very sick from COVID-19. Plan sponsors may permit the plan to cover these and other specified preventive care benefits at no cost or with some form of cost sharing.
The Notice 2019-45 Appendix reads as follows:
PREVENTIVE CARE FOR SPECIFIED CONDITIONS | FOR INDIVIDUALS DIAGNOSED WITH |
Angiotensin Converting Enzyme (ACE) inhibitors | Congestive heart failure, diabetes, and or
coronary artery disease |
Anti-resorptive therapy | Osteoporosis and/or osteopenia |
Beta-blockers | Congestive heart failure and/or coronary
artery disease |
Blood pressure monitor | Hypertension |
Inhaled corticosteroids | Asthma |
Insulin and other glucose lowering agents | Diabetes |
Retinopathy screening | Diabetes |
Peak flow meter | Asthma |
Glucometer | Diabetes |
Hemoglobin A1c testing | Diabetes |
International Normalized Ratio (INR) testing | Liver disease and/or bleeding disorders |
Low-density Lipoprotein (LDL) testing | Heart disease |
Selective Serotonin Reuptake Inhibitors (SSRIs) | Depression |
Statins | Heart disease and/or diabetes |
If our employees are no longer working, are they still entitled to group health plan coverage?
Not necessarily. You need to check your group health plan document (or certificate of coverage if your plan is fully insured) to determine how long employees who are not actively working may remain covered by your group health plan. Once this period expires, active employee coverage must be terminated (unless the insurance carrier or self-funded plan sponsor otherwise agrees to temporarily waive applicable eligibility provisions or cover employee’s share of premiums), and a COBRA notice must be sent. If your plan is self-funded and you would like to waive applicable plan eligibility provisions, you should first make sure that any stop-loss coverage insurance carriers agree to cover claims relating to participants who would otherwise be ineligible for coverage.
If we utilize contractors or temporary employees to supplement our labor force, may those individuals participate in our group health plan?
It depends on plan terms. Independent contractors are most often excluded from group health plan eligibility because of potential tax issues and the risk of inadvertently creating a multiple employer welfare arrangement. By contrast, the law allows an employer to include, or exclude, temporary employees so plan terms must be examined for guidance. However, for ACA employer mandate purposes, temporary employees may trigger liability under the employer mandate even if hired through a staffing agency. Applicable large employers recall that ACA health insurance benefit obligations arise when an employee is reasonably expected to, or actually performs 130+ hours of service in a calendar month. As a result, employers who engage temporary employees to fill short-term needs relating to COVID-19 should ensure they are classified properly for eligibility purposes and that hours are measured in compliance with the employer’s ACA measurement method for full-time employees.
Fisher Phillips, one of our partner law firms, has a dedicated employer focused COVID -19 Q&A and other resources on their website covering a variety of employment, benefits, HIPAA and immigration issues related to COVID-19.
This newsletter is brought to you by your Partner Firm of United Benefit Advisors – the nation’s leading independent employee benefits advisory organization with more than 200 Partner offices in the U.S., Canada, England, and Ireland – and Fisher Phillips. With 36 offices and attorneys practicing throughout the U.S., Fisher Phillips provides the resources to address every aspect of the employee/employer relationship. This newsletter is provided for informational purposes only. It is not intended as legal advice nor does it create an attorney/client relationship between Fisher Phillips LLP. and any readers or recipients. Readers should consult counsel of their own choosing to discuss how these matters relate to their individual circumstances. Reproduction in whole or in part is prohibited without the express written consent of Fisher Phillips. This newsletter may be considered attorney advertising in some states. Furthermore, prior results do not guarantee a similar outcome.