When a fully-insured Plan Sponsor collects premiums, for example COBRA premiums, is the Plan Sponsor performing a plan administration function that requires it to meet the HIPAA privacy plan document and firewall requirements? Or can this be considered solely enrollment information that falls within the exception?