HIPAA for employer group health plans
How HIPAA applies to the health plans employers sponsor: when the plan is a covered entity, fully insured vs self-insured duties, what HR may see as plan sponsor, TPAs and wellness programs.
On this page
HIPAA for employer group health plans: at a glance
HIPAA doesn't regulate an employer acting as an employer, but it does regulate the employer's group health plan. A group health plan is a covered entity unless it has fewer than 50 participants and is administered solely by the employer that established and maintains it. Self-insured plans carry the full Privacy and Security Rule duties; fully insured plans remain covered entities, but if they receive only summary health information and enrollment data, they are exempt from many Privacy Rule administrative duties. Before the employer, as plan sponsor, gets plan PHI, the plan documents must be amended, and the PHI can never be used for employment decisions.
| Covered entity | The group health plan — not the employer as an employer |
|---|---|
| Small-plan exception | Not a HIPAA health plan only if fewer than 50 participants AND administered solely by the employer |
| Fully insured, hands-off | Still a covered entity; exempt from many Privacy Rule administrative duties if it receives only summary and enrollment data |
| Self-insured | Full Privacy and Security Rule duties; TPAs are business associates |
| Plan sponsor access | Requires amended plan documents and a firewall; no employment-related use |
The plan is covered, not the employer
HIPAA covers health plans, and a group health plan — an ERISA employee welfare benefit plan providing medical care, insured or self-insured — is a health plan unless it has fewer than 50 participants and is administered solely by the employer that established and maintains it — both conditions (45 CFR 160.103). The employer that sponsors the plan is not a covered entity in its role as employer: HHS notes that HIPAA generally doesn’t cover employment records, such as sick-leave notes or workplace drug tests. Those may be protected by other laws (ADA, FMLA, state laws).
The legal entity is the plan, but in practice the employer’s benefits staff run it, so the employer has to set up the plan’s compliance.
Fully insured or self-insured
| Fully insured, plan receives only summary and enrollment data | Self-insured (or insured plan that receives PHI) | |
|---|---|---|
| Who pays claims | Insurer or HMO | The plan, usually through a TPA |
| Privacy Rule duties of the plan | Still a covered entity, but exempt from most administrative requirements of 164.530 (164.530(k)) | Full: privacy official, policies, training, safeguards, complaints, NPP |
| Security Rule | Applies to any ePHI the plan holds | Applies in full |
| Typical PHI at the employer | Enrollment and disenrollment; summary health information for premium bids or plan changes | Claims data, appeals, stop-loss reports |
Summary health information summarizes claims history, expenses or types of claims by individual, with most identifiers removed except five-digit ZIP code (164.504(a)). A plan may give it to the sponsor to obtain premium bids or to modify or terminate the plan.
What HR may see as plan sponsor
Before a group health plan discloses PHI to the employer for plan administration, the plan documents must be amended to say what the sponsor may do with it, and the sponsor must certify it will follow those terms (164.504(f)). Among the required terms:
- Only the employees or classes of employees named in the plan documents may access the PHI — a firewall between plan administration and the rest of the company.
- The sponsor may not use or disclose the PHI for employment-related actions or decisions, or for any other benefit plan.
- Safeguards, reporting of improper uses, and return or destruction of the PHI when no longer needed.
TPAs, brokers and vendors
Third-party administrators, pharmacy benefit managers, benefits administration platforms and brokers that handle plan PHI are business associates of the plan and need BAAs.
Wellness programs
HHS distinguishes wellness programs offered as part of a group health plan — where the plan’s PHI is protected by HIPAA — from programs the employer offers directly, outside the plan, which HIPAA generally doesn’t cover. Other laws may still apply to the latter.
Main risks
- HR staff who handle both benefits and employment decisions using plan information for employment purposes.
- Self-insured plans without amended plan documents, a privacy official or HIPAA policies.
- TPAs, brokers or benefits platforms handling plan PHI without BAAs.
- Claims reports with identifiable information sent to managers who don't administer the plan.
- Assuming that because the employer isn't a covered entity, the plan isn't either.
Requirements that matter most here
- Covered entity →§ 160.103What makes an organization a HIPAA covered entity, the three types, how the provider test works, and what covered entities must do.
- Business associate agreements (BAAs) →§ 164.502(e)A vendor that creates, receives, maintains or transmits PHI on your behalf is generally a business associate, and you need a signed BAA with it before it touches patient data. No BAA means you should not put PHI in that tool.
- Minimum necessary →§ 164.502(b)What the HIPAA minimum necessary standard requires, when it does not apply, and how small practices put it into practice with role-based access and standard disclosure limits.
- HIPAA policies and procedures →§ 164.316What written policies and procedures HIPAA requires, how to keep them current, and how long to keep them — for small practices and business associates.
- Notice of Privacy Practices →§ 164.520What the Notice of Privacy Practices must say, when and how a practice must provide it, where it must be posted, and what changed in 2026.
- HIPAA training requirements →§ 164.530(b)Who must be trained under HIPAA, on what, how often, and how to document it — and what the rule does not actually require.
- Security risk analysis →§ 164.308(a)(1)(ii)(A)Every covered entity and business associate must document an accurate and thorough assessment of risks to the ePHI it holds — and then act on it. It is one of the most commonly missing pieces of HIPAA compliance, including in small practices.
- PHI and ePHI →§ 160.103What counts as protected health information under HIPAA, how ePHI differs, what is excluded, and practical examples for small practices and health tech companies.
Solutions to look at
- HIPAA email services →ToolEmail services that sign a BAA, compared on what actually protects patient messages — and what you still have to configure yourself.
- Cloud storage and file sharing →ToolCloud storage services that sign a BAA — on which plans, how you put the agreement in place, and what you must configure before storing patient files.
- Online HIPAA training courses →ToolOnline HIPAA training for staff — what each course covers, how long it takes, what it costs, and whether owners get completion records that help document the workforce training HIPAA requires.
- HIPAA compliance software →ToolPlatforms that help you run a HIPAA program — policies, risk analysis, staff training and vendor BAAs in one place — compared on what they actually include and whether they publish prices.
If something happens
- You had a data breach →A misdirected email, a lost laptop, a hacked mailbox. What to do, in order, in the first days — and the deadlines that start running when you discover it.
- HIPAA training for new employees — and the rest of onboarding →What HIPAA training a new employee needs, when, and how to document it — plus the access steps when someone joins your practice or company and when they leave.
- You received a letter from OCR →A complaint investigation or compliance review from the HHS Office for Civil Rights. What the letter means, what to send, and how these cases usually end.
Your path to compliance
- Confirm HIPAA applies to you and in which role — Does HIPAA apply?
- Put the requirements above in place, starting with a documented risk analysis.
- Choose how to do the work — yourself, with templates, software, a consultant or an attorney — compare every route.
Frequently asked questions
Does HIPAA apply to employers?
Not to the employer in its role as employer — sick notes, drug tests and workplace records are generally outside HIPAA. It applies to the group health plan the employer sponsors, and limits what plan information the employer may receive.
What is the difference between a fully insured and a self-insured plan under HIPAA?
In a fully insured plan the insurer carries most HIPAA duties; the plan is still a covered entity, but if it receives only summary health information and enrollment data, it is exempt from many Privacy Rule administrative duties. A self-insured plan handles claims data through the employer or a TPA and must meet the Privacy and Security Rules in full.
Can HR see employees' claims information?
Only plan administration staff named in the amended plan documents, only for plan administration, and never for hiring, firing, discipline or other employment decisions.
Is our TPA a business associate?
Yes. A third-party administrator that processes claims for a group health plan is a business associate of the plan and needs a BAA.