HIPAA, Benefits Compliance, Employee Benefits Compliance, Reporting Requirements

March Madness! Notify OCR if HIPAA Breach in 2017, CMS on Medicare D Coverage, ALEs file 1094/95-Cs and MEWAs file M-1s

march madness

For basketball fans, March Madness means it’s time for the annual NCAA college basketball tournament.  For employers who sponsor group health plans, March Madness might mean it’s time to file various benefit plan notices and forms with the federal government.  Not quite the fun or excitement of college basketball March Madness.  Here are the players and the plays for the plan sponsor March Madness:

Players:  Employers who had a HIPAA “breach” of unsecured protected health information (PHI) in 2017, and the breach involved the PHI of fewer than 500 individuals: 

Play: You must notify the Office for Civil Rights (OCR) by March 1, 2018.   Covered entities (such as group health plans) must track any breaches of unsecured PHI in a log, and that must be submitted to OCR within 60 days after the end of each calendar year. This deadline applies whether your plan year is the calendar year or an off-calendar year.  This requirement to notify OCR applies whether the breach occurred to the group health plan or to a business associate of the plan that held or transmitted PHI of plan participants.  The Business Associate Agreement (BAA) should specify whether the plan or the business associate is obligated to notify OCR if the breach involved PHI held by the business associate.  Even if the BAA states that it’s the business associate’s obligation, the plan sponsor should confirm with the business associate that the breach was reported to OCR.  If the breach involved the PHI of 500 or more individuals, you should have notified OCR (as well as the affected individuals) within 60 days after the breach was discovered.  Click here for a link to the OCR Breach reporting page.

Players:  Employers who offer prescription drug coverage to individuals who are eligible for Medicare Part D: 

Play: You must go online and tell the Centers for Medicare and Medicaid Services (CMS) whether the prescription drug coverage you offer is “Creditable” or “Non-creditable” with Medicare Part D Prescription drug coverage.  “Creditable” means the group health plan’s expected paid claims for prescription drug coverage is at least as much as the expected paid claims under the standard Medicare Part D prescription drug plan.  “Non-creditable” means the employer plan coverage is not as good as Medicare Part D’s prescription drug benefit.  The deadline to notify CMS is within 60 days after first day of plan year.  For calendar year plans, the deadline is March 1.  Non-calendar year plans should calculate due dates.   Employers go online to https://www.cms.gov/Medicare/Prescription-Drug-Coverage/CreditableCoverage/CCDisclosureForm.html  .  For additional details, click here for a recent article on this site.

Players:  Employers who were “applicable large employers” (ALEs) in 2017 (meaning you employed at least 50 full-time employees or “full-time equivalent” employees in 2016):

Play #1: You must furnish 1095-C’s to all your full-time employees by March 2, 2018.  (The IRS extended the original due date of January 31.)  ALEs are subject to the ACA employer mandate (“employer shared responsibility”) and will be subject to penalties if they did not offer “minimum essential coverage” to at least 95% of their full-time employees, or if the coverage offered did not provide at least minimum value or was not affordable, and if at least one full-time employee qualifies for a subsidy to buy health insurance in the marketplace.  ALEs must provide full-time employees with an IRS form 1095-C to document group health coverage they were offered or enrolled in during 2017.

Play #2: You also must file your 1094-C & 1095-Cs with the IRS.  If you file these with the IRS electronically, you must file by April 2, 2018 (because March 31 is a Saturday). Generally, an entity who is required to file more than 250 of the same form must file electronically. If you are an ALE but had fewer than 250 health plan participants all year, you can elect either electronic or paper filings. Paper copies were due by February 28, so if you missed that deadline you can timely file by April 2nd if you file electronically.

Players:  Employers who were small employers who offered self-funded group health plan coverage in 2017:

Play #1: You must furnish 1095-B‘s to full-time and part-time employees who enrolled in the self-funded group health plan at any time in 2017.  These must be furnished by March 2, 2018.

Play #2:  You also must file your 1094-B & 1095-Bs with the IRS. If you file these with the IRS electronically, you must file by April 2 (because March 31 is a Saturday). You are not required to file electronically, but you can elect to do so. Paper copies were due by February 28, so if you missed that deadline you can timely file by April 2nd if you file electronically.

Players:  Employers who offered group health plan coverage to employees through a multiple employer welfare arrangement (MEWA) in 2017:

Play: Either you or the MEWA administrator must file Form M-1 with the federal Department of Labor (DOL) by March 1st each year.   The M-1 provides information about the prior calendar year, and must be filed electronically.  If you participate in a MEWA and the ERISA plan is at the MEWA level, the MEWA administrator should file the Form M-1.  If you are a single employer and you offer group health plan coverage to your employees and also to employees who are employed by another employer who is not part of your controlled group, you (or your TPA) should file the Form M-1 for your group health plan.

Players: Employers who sponsor group health plans subject to ERISA, and the plan year start date was January 1st (i.e., plan year is the calendar year): 

Play:  Distribute Summary Plan Descriptions (SPDs) to participants by March 30th.

Players: Employers with at least 100 employee and employers with federal government contracts of $50,000 or more and at least 50 employees:

Play: You must submit your 2017 EEO-1 report to the EEOC (Equal Employment Opportunity Commission) by March 31st. Click here for EEO-1 reporting information. Note that the pay data collection aspect of the EEO-1 form, previously announced by the EEOC, has been suspended under the Trump administration.