Guidance on Supplemental Plans and HIPAA

March 11, 2008

Some benefits are excepted from the HIPAA portability regulations. These benefits include "supplemental" coverage under a separate policy, certificate, or contract of insurance. In December 2007, the DOL issued safe harbor rules in Field Assistance Bulletin 2007-04 concerning what "supplemental" coverage is exempt from HIPAA's portability rules under this exception, noting that the IRS is also responsible for enforcement.

The IRS’s version of the same safe harbor rules is Notice 2008-23, issued in February 2008. Under the HIPAA exception, supplemental coverage includes:

• Medicare supplemental health insurance (i.e., "Medigap" insurance)
• TRICARE supplemental coverage
• "Similar supplemental coverage provided to coverage under a group health plan."

Coverage is "similar supplemental coverage," if it is a separate policy, certificate or contract of insurance that satisfies these four requirements:

• The carrier does not provide the primary coverage under the group health plan
• The coverage specifically supplements gaps in primary coverage, like co-insurance and deductibles
• The cost is no more than 15 percent of the cost of primary coverage
• The coverage does not distinguish between individuals in terms of eligibility, benefits or premiums based on any health factor

What prompted the guidance? Some carriers were marketing insurance products as HIPAA-excepted without satisfying the above requirements. Keep in mind that this is a safe harbor. It is possible that other insurance products may qualify for the exception, but such determinations would be on a case-by-case basis and are unlikely given the fact that the DOL, the IRS and the Department of Health and Human Services all share enforcement duties related to HIPAA portability.

A copy of the Notice is available at: www.irs.gov/pub/irs-irbs/irb08-07.pdf.