It seems to me that a majority of health plans will have an additional year (i.e., until April 14, 2004) to comply with the HIPAA Privacy Rule because they are fully insured and the premiums for the prior year did not exceed $5 million (it would be quite the large plan that pays more than $5 million in premiums). What does everyone else think?

Suppose an employer sponsors a fully insured medical plan and a fully insured dental plan. In determining whether the medical plan (which I believe is a separate covered entity from the dental plan - although they may be part of an organized health care arrangement) is a "small" plan, would you only consider premiums paid for the medical plan or would you also include the dental plan premiums?

While it is not clear, the general consensus is that multiple fully insured plans combined as a wrap plan for 5500 filing purposes are combined for determining whether the $5 million threshold. If the plans are not combined, then the premiums for each could be considered separately.

As a practical matter, however, the insurance company vendors will be coming into compliance for their own purposes this year. Many of the compliance requirements for fully insured plans are deferred to the insurance companies. Employers in the circumstances you describe may want to consider aligning their processes with the (hopefully) compliant processes of their vendors regardless of the actual compliance date.