If a company has self-funded medical, dental, vision and flexible spending plans (that have their own plan documents), is it possible to issue one Notice of Privacy Practices and have the other relevant privacy requirements apply to them as a unit? I know the topic of treating the plans as an OHCA has been discussed and would seem to apply. But, based on the regs, it appears that nothing formal is required to declare the plans as an OHCA, either in the plan document or in the Notice of Privacy Practices. Are there any specific requirements that must be performed to be an OHCA?

Does anyone have any thoughts? Thanks.

You're right. There does not appear to be anything formal that an employer should do to designate an OHCA. The regs say specifically that multiple health plans can be treated as an OHCA, however.

So long as the NOPP accurately describes the practices of each of the plans, a joint NOPP can be issued.

Steve72,

many thanks for your insight. The regs regarding the NPP call for the inclusion of a statement regarding the sharing of PHI between the various plans, "covered entities participating in the organized health care arrangement will share PHI with each other, as necessary to carry out, treatment, payment, or health care operations to the organized health care arrangement."

as a practical matter, is there not sharing of PHI as identified above in a company that sponsors a number of self-insured plans? I would not think that a company segregates its plans and the people working on the plans from each other.