Acronym Soup: Nailing Down the Essentials of HIPAA, COBRA, and ERISA Printer friendly format


Sometimes working through the intricacies of HIPAA, COBRA, and ERISA can be a very daunting task.  My goal in this piece is to give you a general overview of the main components of these three massive laws. I won’t get into all the nitty-gritty details, but by the time we’re finished you should have a better understanding of the big picture—as well as what these laws are designed to do beyond making your life more difficult. 
ERISA: The Employee Retirement Income Security Act
The Employee Retirement Income Security Act (ERISA) is all about making the provision of employee benefits fair and predictable. It doesn’t require employers to provide benefits—but it does establish rules for those that do:
  • Rules to prevent the unjust enrichment, benefits-wise, of highly compensated employees
  • Rules about plan information that must be disclosed to participants
  • Rules relating to the fiduciary obligations of the people in charge of the plan and its assets
ERISA covers “welfare plans”: plans, funds, or programs established or maintained to provide:
  • Medical, surgical, or hospital care or benefits;
  • Benefits in the event of sickness, accident, disability, death, or unemployment;
  • Vacation benefits;
  • Apprenticeships or other training programs;
  • Daycare centers;
  • Scholarship funds; 
  • Prepaid legal services; and
  • Any benefit described in the Management Relations Act of 1961 except pensions
Some examples of ERISA-covered welfare plans include group health plans (including dental and vision), multiple employer welfare arrangements (MEWAs), some severance pay plans, HRAs, MSAs, HSAs, and FSAs. (Yes, folks, more acronyms!)
Note that a plan may be covered by ERISA whether the plan is funded directly by the employer or through an insurance arrangement. 
Another important thing to remember about ERISA: It is expressly designed to pre-empt (or trump) state law in nearly all situations relating to employee benefits. So ERISA, rather than state law, applies when determining liability and remedies.

Who’s covered by ERISA? ERISA covers employee benefit plans established or maintained by employers, employee organizations, or both. Certain “payroll practices” (such as compensation premiums and vacation pay) are not considered employee benefit plans, and certain plans are exempt (such as governmental plans), but in general it’s safe to assume your benefit plan is covered.
COBRA: The Consolidated Omnibus Budget Reconciliation Act of 1985
The “COBRA” acronym is understandable, given what a mouthful it is to spell the whole thing out. Consolidated Omnibus Budget Reconciliation Act (COBRA), in a nutshell, exists to provide workers and their families a temporary extension of their healthcare benefits when coverage would otherwise be lost due to a “qualifying event.” These folks pay a premium for the extension—more on this later—but the idea is to prevent gaps in coverage.
What’s a qualifying event? 
For covered employees
  • Termination of employment (voluntary or involuntary) for reasons other than “gross misconduct”
  • Reduction in the number of work hours
For covered employees’ spouses
  • Termination of covered employee’s employment (voluntary or involuntary) for reasons other than “gross misconduct”
  • Reduction in the number of work hours for the covered employee 
  • Divorce or separation from, or death of, the covered employee 
  • The covered employee becomes entitled to Medicare
For covered employees’ dependents
  • Termination of covered employee’s employment (voluntary or involuntary) for reasons other than “gross misconduct”
  • Reduction in the number of work hours for the covered employee 
  • Divorce, separation, or death of the covered employee 
  • The covered employee becomes entitled to Medicare
  • Loss of dependent child status under the plan rules
For retiree workers, their spouses, and their dependents, the former employer’s commencement of Chapter 11 bankruptcy proceedings is also a qualifying event.
The maximum coverage period under COBRA ranges from 18 months to 36 months, depending on the nature of the qualifying event.
COBRA generally allows workers and their families to keep the same health plan they had before the qualifying event, but these folks usually need to pick up the portion of the premium the employer was paying before. The COBRA premium generally cannot exceed 102% of the applicable premium, or 150% of the applicable premium during the extended coverage period provided as part of a disability extension.
What’s the “applicable premium,” you may well ask? Good question. While there’s little official guidance on how to calculate it, it’s based on the cost to the plan for similarly situated beneficiaries who have not experienced a qualifying event (individuals in your plan who remain employed with you, for example).
Who’s covered by COBRA? Most group health plans are covered by COBRA. One exception is plans run by “small employers”—defined as employers with fewer than 20 employees employed on at least 50% of its typical business days during the previous calendar year.
HIPAA: The Health Insurance Portability and Accountability Act of 1996
Everybody talks about the Health Insurance Portability and Accountability Act (HIPAA) like it’s one great big monster of a law, but it’s actually two very different laws rolled into one package—kind of like a less-tasty version of Reese’s Peanut Butter Cups. One part of the law protects individuals’ access to health insurance, while the other part protects the privacy of their health information.
Access to health insurance
If COBRA provides the extension bridge that helps transport you over to new coverage, HIPAA provides the foot in the door of that new coverage that prevents it from being slammed in your face when you arrive. 
HIPAA is meant to make it easier for people to obtain new health coverage after prior coverage stops—hence the “portability” in the name—by putting limitations on preexisting condition exclusions, requiring health plans to open up for special enrollment periods in certain circumstances, and prohibiting discrimination in eligibility exclusions on the basis of health status.
HIPAA really applies only to health insurance—it does not cover, for example, liability insurance, workers’ comp insurance, and coverage for on-site medical clinics. 
Privacy of health information
“Here’s your HIPAA form to sign.” You have undoubtedly heard this statement multiple times since the law was passed, almost every time you’re in a doctor’s office. This form relates to HIPAA’s privacy provisions.
HIPAA is meant to safeguard individuals’ protected health information (or “PHI”). In general, PHI is all individually identifiable health info about a person that is handled by a covered entity or its business associates. 
HIPAA also provides special protections and safeguards for electronic PHI—PHI that is transmitted by electronic media or maintained in electronic media.
So while all ePHI is PHI, not all PHI is ePHI. (As a character on the Big Bang Theory so memorably put it, “All thumbs are fingers, but not all fingers are thumbs.”)
Who’s covered by HIPAA? HIPAA applies to group health plans and health insurance issuers that offer group health insurance coverage in connection with a group health plan. Generally, a “group health plan” is one that is maintained by an employer and provides medical care to employees and their dependents. Certain plans that offer only separate benefits—such as limited-scope dental or vision—are exempt from HIPAA.
Additionally, if you handle PHI and/or ePHI in any way, it’s safe to assume you are covered by HIPAA.
I hope this big-picture overview has helped you find your footing with respect to ERISA, COBRA, and HIPAA. The laws are big and multi-tentacled, but important to get your arms around.

Reprinted with permission from