We have a self-insured EAP. It is my understanding that the EAP provider requires a Business Associate Agreement. It is also my understanding that the HIPAA Privacy Notice should be mailed by us (the employer) since it is a self-insured plan. We are planning to mail it to all eligible employees. Is this what other employers are doing who have self-insured plans?

That's what I've advised clients.

Thanks for the confirmation.

I have a follow up question.

A little background first. We have self-insured medical, dental, FSA and EAP plans. Our initial plan was to send a privacy notice to the participants of each of these plans. When we realized however that the EAP would result in all benefits eligible employees receiving one, our legal department decided that only one notice was necessary.

It's not that I am questioning my legal department but I wondered if others in a similar situation were doing the same thing.

Thanks.

You can send a joint notice if you designate all of your plans as an "Organized Health Care Arrangement". You just need to make sure the procedures in the notice apply to all of the plans.