I need some help on this one. Company A sponsors large self-insured health plan
named "Company A Health Plan" and sent HIPAA privacy notices to all primary members Feb. 2003. Company A also owns 98% of Company B which sponsors a small (under $5 million) self-insured health plan named "Company B Health Plan"
Company A also owns majority interest in several other LLC that sponsor small self-insured plans in the LLC business name.

Question: Are each of these plans a different Covered Entity? and if so,
if more than one the seperate plans uses the same Business Assoicate is it necessary to have seperate BA agreements written in the name of each plan?

My gut feeling tells me each of the plans sponsored by Company B, C, D... will need to have seperate privacy notices/BA agreements/plan addendums in the plan (Covered Entity) name. They will not beable to simply rely on the parent "Company A" HIPAA compliance as compliance for all its owned LLC company health plan compliance(since a company is not a Covered Entity it's health plan is).

Let me know your thoughts

jgf810,

It does sound like that each plan is a separate covered entity, but you need to go to to FR 164.104 in the HIPAA regs and see if you meet the definition of an Affiliated Covered Entity (ACE) for each. There are certain requirements you must meet, but it does make things easier for the paperwork - notice, BAAs, etc...

I have done this for providers who are covered entities, but I read the regs and I think you can also do it for health plans. It is worth checking out.