ACA Information Reporting May Create HIPAA Privacy and Security Concerns for Employers

The Affordable Care Act (ACA) added various reporting requirements for health plans and employers, including employer information reporting requirements under Section 6055 and 6056. Information gathering will be critical to successful reporting but collecting more sensitive information about employees may raise additional data privacy and security risks.

Under the ACA, providers of “minimum essential coverage” (MEC) must report certain information about that coverage to the Internal Revenue Service (IRS), and to persons receiving that MEC. Providers of minimum essential coverage will use Forms 1094-B, 1095-B, 1094-C and 1095-C to report this information.

Depending on the type of provider, they will need to report on detailed employee data, including names, Social Security Numbers of each employee and covered dependents and months during which health coverage was offered and provided in 2015.

Information gathering will be critical to successful reporting but collecting more sensitive information about employees may raise additional data privacy and security risks.

Collecting this information will be an increased burden, creating more risks on employers given the increased amount of sensitive data that they will be handling, and possibly from vendors working on their behalf. Some steps employers can take to mitigate these risks include:

Employers navigating through the ACA reporting requirements have many issues to consider and how personal information or protected health information is safeguarded in the course of those efforts is one more important consideration. Employers need to prepare now for this upcoming obligation by putting procedures in place. Especially since penalty amounts were recently increased for employers subject to the ACA’s information reporting requirements.

Employers that fail to comply with the requirements may be fined for failing to file correct information returns and for failing to provide correct information returns to employees. The penalty for failing to file an information return increased from $100 to $250 for each return, with a cap of $3 million. The penalty for failing to provide correct employee information to employees also increased from $100 to $250 for each return.

ComplyRight Distribution Services (CDS) offers a secure print-and-mail solution for businesses looking to outsource this function. The CDS facility is HIPAA Certified and has achieved SOC certification from the American Institute of CPAs. So employers can rest assured that all information will remain protected throughout the process, and they will not be exposed to a potential data breach.