What Are the Basic Provisions of HIPAA?

The Health Insurance Portability and Accountability Act is a federal law that establishes protections and rights for participants in employer-based health plans. Key provisions require the plans to limit exclusions due to preexisting conditions and refrain from any discriminatory action against employees based on health status. The law also sets boundaries for the sharing of an individual's health information by insurers and providers.

Preexisting Conditions

• Under HIPAA, group health plans may exclude an individual's preexisting condition only if it required diagnosis or treatment during the previous six months, and may exclude it only for a maximum of 12 months. For late enrollees, the exclusion period may last up to 18 months. Furthermore, the plan must reduce the 12- or 18-month waiting period by the length of time for which the individual previously had continuous health coverage in a group or individual plan. "Continuous" coverage according to this provision, is coverage without an interruption of 63 days or more.

Discrimination Prohibitions

• Group plans may in no way discriminate against an individual based on health factors. Potentially discriminatory actions include coverage exclusion, denial of benefits and higher out-of-pocket costs. Plans may not require individuals to take a physical as a condition of enrollment. They may require the completion of a health questionnaire, but may not use the information to deny enrollment or restrict benefits or determine individual premiums.

Privacy Requirements

• The Privacy Rule in the HIPAA statute establishes restrictions on who can access an individual's health information. The restrictions apply to private health insurance companies, Medicare and Medicaid, and health care providers, but do not apply to life insurers and employers, among other entities. Protected information includes medical records and information in an insurance company's database, billing information at a clinic and most other health information in the possession of those who must follow the laws. Insurance companies and health care providers must comply with an individual's requests to receive a copy of his records.

Limitations

• HIPAA mandates go only so far. For example, the law does not require employers to offer health coverage as a benefit of employment. It also allows plans to exclude certain conditions from coverage altogether, as long as the exclusion applies to all participants and not just those with certain health issues. HIPPA also allows plans to impose exclusion periods for preexisting conditions, as long as the period does not exceed the 12- or 18-month time frame. Insurers may levy higher premiums on participants in one group plan than on participants in another based on an assessment of risk factors. But within a plan, the premiums must be based on equal rates.