ERISA Benefits Law Desk ReferenceERISA Benefits Tech, LLC

Part 13 · Chapter 3

HIPAA Compliance for Group Health Plans

Law stated as of October 3, 2026 · COBRA, HIPAA, and Welfare Benefits

Scope and status

This chapter states the durable HIPAA framework as it applies to employer-sponsored group health plans, noting current regulatory status where rules have recently changed or are in flux. Current regulatory text and any pending rulemaking should be confirmed before relying on it.

HIPAA splits into two regimes for an employer plan: Title I group-health-plan rules (portability, special enrollment, health-status nondiscrimination) and Administrative Simplification (Privacy, Security, and Breach Notification). The bulk of this synthesis addresses Administrative Simplification; the Title I rules are summarized first because they are where most day-to-day enrollment issues arise.

Sections

The first section is shown in full. The other sections are listed by title; their text is available to subscribers.

HIPAA Title I — Portability, Special Enrollment, and Health-Status Nondiscrimination

The Title I group-health-plan rules are codified in parallel across the Code, ERISA, and the PHSA and implemented by joint Treasury/DOL/HHS regulations (the 2004 portability final rule, 69 Fed. Reg. 78720, and the 2006 health-factor nondiscrimination final rule, 71 Fed. Reg. 75014). Final reg: 26 C.F.R. Part 54; 29 C.F.R. Part 2590; 45 C.F.R. Part 146.

  • Special enrollment. A plan must offer special enrollment outside the annual window on loss of other coverage (and exhaustion of COBRA), and on marriage, birth, adoption, or placement for adoption, plus the CHIPRA events (loss of Medicaid/CHIP eligibility, or gaining premium-assistance eligibility). The request window is generally 30 days (60 days for the CHIPRA events). Statute: ERISA §701(f); Final reg: 29 C.F.R. §2590.701-6. An employer whose plan covers residents of a State offering Medicaid/CHIP premium assistance must also give each employee the annual premium-assistance notice; the DOL penalty is up to $145/day per employee (2025 amount; no 2026 adjustment). Statute: ERISA §§701(f)(3)(B)(i)(I), 502(c)(9)(A); DOL penalty adjustment: 90 Fed. Reg. 1854; 91 Fed. Reg. 31358. Statute: ERISA §702; Final reg: 29 C.F.R. §2590.702, -702(f). Under FAQs Part 74 (Aug. 26, 2026), the Departments will not enforce against a reward paid only prospectively after a reasonable alternative is satisfied. Agency guidance — informal: FAQs Part 74. Coordinate with GINA and the ADA for medical-inquiry/incentive limits; the full wellness analysis lives in Part 16 (FMLA, USERRA, and Wellness Programs).
  • Portability (largely historical). The preexisting-condition-exclusion and creditable-coverage-certificate machinery is largely superseded by the ACA's ban on preexisting-condition exclusions; treat it as background unless a pre-2014 period is in issue. Statute: ERISA §701; Practitioner consensus.
  1. Scope: When the Administrative-Simplification Rules Apply to an Employer's PlanSubscribers
  2. Business Associates and SubcontractorsSubscribers
  3. Privacy Rule EssentialsSubscribers
  4. Security Rule EssentialsSubscribers
  5. Breach NotificationSubscribers
  6. Plan-Sponsor Firewall and Plan-Document RequirementsSubscribers
  7. State Law and Multistate AdministrationSubscribers
  8. Issue-Spotting ChecklistSubscribers

The first Part of each chapter is open to everyone. The remaining sections, with their authority and practice points, are available to subscribers and to clients of ERISA Benefits Law Group, PLLC whose engagement includes access.

Sign inSubscribe