Compliance dates

OCR Privacy Brief: Summary of the HIPAA Privacy Rule

Compliance Schedule. All covered entities, except "small health plans," must be compliant with the Privacy Rule by April 14, 2003.⁹⁰ Small health plans, however, have until April 14, 2004 to comply.

Small Health Plans. A health plan with annual receipts of not more than $5 million is a small health plan.⁹¹ Health plans that file certain federal tax returns and report receipts on those returns should use the guidance provided by the Small Business Administration at 13 Code of Federal Regulations (CFR) 121.104 to calculate annual receipts. Health plans that do not report receipts to the Internal Revenue Service (IRS), for example, group health plans regulated by the Employee Retirement Income Security Act 1974 (ERISA) that are exempt from filing income tax returns, should use proxy measures to determine their annual receipts.⁹²See What constitutes a small health plan?

⁹⁰45 C.F.R. §164.534.

⁹¹45 C.F.R. §160.103.

⁹²Fully insured health plans should use the amount of total premiums that they paid for health insurance benefits during the plan's last full fiscal year. Self-insured plans, both funded and unfunded, should use the total amount paid for health care claims by the employer, plan sponsor or benefit fund, as applicable to their circumstances, on behalf of the plan during the plan's last full fiscal year. Those plans that provide health benefits through a mix of purchased insurance and self-insurance should combine proxy measures to determine their total annual receipts.