boxsolid
HIPAA (continued from page 23)
Law
Compliance Plans Compliance Amendment
Snapshot Affected Deadline Required or
Merely
Change in
Administration
Michelle’s Law Group health plans must Health plans (includ- Plan years begin- Amendment/SMM
continue to allow eligibility ing FSAs and HRAs) ning on or after required.
for dependents for up to that condition depend- October 9, 2009
one year after change in ent eligibility beyond a Administration changes
school enrollment status if certain age on full-
change in enrollment is the time student status
result of medical necessity may need to allow con-
and commences while the tinued participation.
dependent is suffering from
a serious illness or injury.
Transit Debit In September 2008, the Transit Fringe Benefit January 1, 2010 Administration changes
Card Guidance IRS issued Notice 2008- Plans for those transit plans
in IRS Notice 74, which delayed (again) that allow debit cards
2008-74 the effective date of the
transit debit card guidance
set forth in Revenue
Ruling 2006-57 until
January 1, 2010. The for-
mal ruling does not com-
ment on the validity of
existing arrangements.
HIPAA Imposes specific provisions Health plan sponsors Variable effective Administration
Changes of the HIPAA security rule, must adopt and imple- dates: changes and business
under ARRA and, to a lesser extent, the ment breach notifica- associate agreement
privacy rule, on business tion procedures for Breach notification revisions.
associates, and extends the breaches occurring provisions will be
criminal and civil liabilities on/after September 23, effective with
for violations to business 2009. Business asso- respect to breaches
associates. Adds additional ciate agreements occurring on/after
notice requirements in the should be reviewed in September 23,
event of significant security connection with new 2009.
breach. ARRA requirements.
Remainder of
Business associate ARRA provisions
service providers to generally, effective
health plans (including February 17,
FSAs and HRAs) will 2010.
be required to comply
with HIPAA security
and certain privacy
requirements as if they
were covered entities.
24 • The Self-Insurer
©
/ January 2010
Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32