Which health plan does not fall under HIPAA?
Workers' compensation and programs providing only excepted benefits (such as auto medical payment, accident-only coverage, or disability insurance) do not fall under the definition of a health plan under HIPAA.
Excluded Programs and Insurance Types
- Workers' compensation: Run by states to handle work-related injuries, this is legally classified as a separate work-related insurance program rather than a HIPAA health plan.
- Excepted benefits: Standalone policies covering only accident, disability income, liability, or automobile medical payment are explicitly excluded.
- Small self-administered group plans: Group health plans with fewer than 50 participants that are managed entirely by the employer are also exempt.
- Life and property-casualty insurers: These companies operate under separate financial privacy laws unless they concurrently run a major medical health plan.
Who is not covered under HIPAA?
HIPAA does not apply to organizations and individuals that do not meet the legal definition of a Covered Entities and Business Associates or their business associates.
Common Non-Covered Entities
- Employers and HR Departments: General employment records (such as sick leave notes, FMLA forms, drug tests, and workers' compensation files) are not protected by HIPAA when held by an employer in an employment capacity.
- Life and Disability Insurers: Companies underwriting or administering life insurance, disability insurance, or auto insurance are not covered entities.
- Schools and Educational Institutions: Student health and education records managed by K-12 schools and universities are governed by FERPA (Family Educational Rights and Privacy Act) instead of HIPAA.
- Consumer Fitness and Wellness Apps: Standalone health apps, wearable fitness trackers, period-tracking apps, and nutrition platforms that collect data directly from users are generally exempt unless they operate on behalf of a healthcare provider or health plan.
- Law Enforcement Agencies: Police departments, courts, and correctional facilities are not covered entities for regular investigative work or criminal records.
- Other Non-Healthcare Businesses: Data brokers, marketing firms, banks, credit card processors, and general tech or cloud vendors are not covered unless they handle protected health information (PHI) under a formal Business Associate Agreement.
Which group plans do HIPAA rules not apply?
HIPAA rules do not apply to small, employer-administered group health plans with fewer than 50 participants, nor do they apply to non-health benefit plans like disability income, life insurance, or workers' compensation.
Exempt Group and Benefit Plans
- Small Self-Administered Plans: Group health plans with fewer than 50 participants that are managed entirely in-house by the sponsoring employer (not through an insurer or third-party administrator).
- Disability Income Plans: Insurance policies that replace lost income due to disability rather than paying for medical care.
- Life and Auto Insurance: Policies covering life, property, casualty, or auto medical payments.
- Workers' Compensation: Programs providing benefits for work-related injuries or illnesses.
- Excepted Benefits: Stand-alone dental or vision plans, and accident-only coverage.
When HIPAA Does Apply
HIPAA rules do apply to group health plans if they have 50 or more participants, or if they are managed by an outside insurer or third-party administrator (TPA), regardless of how small the group is. You can read more about definitions via the U.S. Department of Health & Human Services.
Is a health plan covered under HIPAA?
Yes, health insurance information is protected by HIPAA when it is held or transmitted by a health plan, health care provider, or clearinghouse.
What Insurance Information is Protected?
Under the HHS Privacy Rule, health insurance data falls under Protected Health Information (PHI) if it is individually identifiable. Protected data includes:
- Past, present, or future payment for health care
- Health insurance claims, billing records, and prior authorizations
- Demographic data and personal identifiers linked to medical conditions or health coverage
Who Must Protect It?
Organizations bound by HIPAA are called covered entities. They include:
- Health plans: Health insurance companies, HMOs, employer-sponsored health plans, Medicare, and Medicaid.
- Health care providers: Doctors, clinics, hospitals, and pharmacies that transmit health data electronically.
- Health care clearinghouses: Entities that process nonstandard health data into standard data.
Which of these is not right under HIPAA?
The correct option that is not a right under HIPAA is: "To control all disclosures of information in the health record."
Explanation
- ❌ To control all disclosures of information in the health record: This is not a right because patients do not have absolute control over every disclosure. Under the HIPAA Privacy Rule, healthcare providers and covered entities are legally permitted to disclose Protected Health Information (PHI) without explicit patient consent for essential purposes such as treatment, payment, healthcare operations, or when required by law enforcement and public health authorities.
- ✅ To gain access to and obtain a copy of one's health record: This is a valid right. Patients have a right to inspect and obtain copies of their medical records within a defined period.
- ✅ To request amendment of errors found in the health record: This is a valid right. If a patient believes information is inaccurate or incomplete, they have the right to request changes or append a statement of disagreement.
- ✅ To receive an accounting of how health information has been used: This is a valid right. Patients can request a history of specific disclosures made by the covered entity.
Which Health Plan Does Not Fall Under Hipaa
Which healthcare plan does not fall under HIPAA?
Workers' compensation and programs providing only excepted benefits (such as auto medical payment, accident-only coverage, or disability insurance) do not fall under the definition of a health plan under HIPAA.
Excluded Programs and Insurance Types
- Workers' compensation: Run by states to handle work-related injuries, this is legally classified as a separate work-related insurance program rather than a HIPAA health plan.
- Excepted benefits: Standalone policies covering only accident, disability income, liability, or automobile medical payment are explicitly excluded.
- Small self-administered group plans: Group health plans with fewer than 50 participants that are managed entirely by the employer are also exempt.
- Life and property-casualty insurers: These companies operate under separate financial privacy laws unless they concurrently run a major medical health plan.
What are the three exceptions to HIPAA?
The three specific exceptions under the HIPAA Breach Notification Rule determine whether an unauthorized acquisition, access, or use of Protected Health Information (PHI) constitutes a reportable breach.
The Three Exceptions to a HIPAA Breach
- Unintentional acquisition, access, or use of PHI: An employee or workforce member accesses PHI unintentionally, in good faith, and within the scope of their authority, without further impermissible disclosure.
- Inadvertent disclosure between authorized persons: A person authorized to access PHI at a covered entity or business associate accidentally discloses that information to another authorized person within the same organization or arrangement, without further impermissible use.
- Good faith belief that the recipient could not retain the information: An unauthorized disclosure where the covered entity or business associate has a good faith belief that the unauthorized person who received the PHI could not have reasonably retained it.
Who are the 3 primary covered entities under HIPAA?
The three primary categories of covered entities under the Health Insurance Portability and Accountability Act (HHS.gov) are healthcare providers, health plans, and healthcare clearinghouses.
As outlined by the Department of Health and Human Services, these groups must protect patient data and comply with HIPAA rules:
1. Healthcare Providers
- Definition: Doctors, clinics, hospitals, psychologists, dentists, chiropractors, nursing homes, and pharmacies.
- Rule for coverage: They are only covered entities if they transmit health information in electronic form for standard transactions (like billing or insurance claims).
2. Health Plans
- Definition: Organizations that pay for or provide medical care.
- Examples: Health insurance companies, HMOs (Health Maintenance Organizations), employer-sponsored group health plans, and government programs like Medicare and Medicaid.
3. Healthcare Clearinghouses
- Definition: Entities that process nonstandard health information into a standard electronic format, or the reverse, acting as middlemen between providers and payers.
- Examples: Billing services, community health management information systems, and value-added networks that reformat data.
What is not an example of HIPAA?
Information held by non-covered entities, such as consumer fitness trackers, period-tracking apps, or life insurance records, is not an example or violation of HIPAA.
💡 Common Examples Not Covered by HIPAA
- Smartwatch Data: Heart rate or sleep logs saved on a commercial app.
- Employment Records: Health info kept by an employer in their HR files.
- School Records: Student health data protected under FERPA instead.
- Life Insurance: Health history requested by a life or disability insurer.
- De-Identified Data: Medical data with all personal identifiers removed.
Are life insurance companies under HIPAA?
No, HIPAA does not generally apply to life insurance companies for their routine underwriting and policies.
Why HIPAA Does Not Apply
- Not Covered Entities: Under the Health Insurance Portability and Accountability Act, life insurers are not classified as "covered entities" because they do not provide health care or operate as medical health plans.
- The Authorization Process: To get your medical records, a life insurance company must have you sign a written authorization (often called a HIPAA waiver or authorization form).
- After Disclosure: Once your medical data is handed over to the life insurance company using your signed permission, it leaves the direct protection of HIPAA.
What Laws Protect You Instead
- State and Financial Laws: Most users on Reddit agree that life insurance data handling is governed instead by financial privacy regulations like the Gramm-Leach-Bliley Act (GLBA) and specific state insurance privacy laws.
- Limited Exceptions: If a life insurance company also sells medical products (like a long-term care rider) or acts as a business associate for a health plan, HIPAA might apply to that specific, separate function.