March 1 Deadlines for Group Health Plans | Venable LLP

March 1 delivers two annual deadlines for companies that sponsor a group health and fitness prepare for their employees.

Medicare Portion D—Creditable Protection Disclosure to CMS

An employer with a group health and fitness plan that gives prescription drug coverage to Medicare-suitable people today need to make an once-a-year disclosure to the Centers for Medicare & Medicaid Expert services (CMS). The disclosure is due 60 times right after the beginning of the system year—no afterwards than March 1, 2022 for calendar-12 months ideas. Businesses have to complete and submit the yearly disclosure electronically on the CMS site.

In get to entire this disclosure, an employer will have to have to offer the subsequent data: (i) the employer’s title, tackle, federal tax identification variety, and phone range (ii) the name, title, and email deal with of the man or woman finishing the kind (iii) the kind of protection presented (iv) the whole selection of prescription drug selections accessible to Medicare-suitable individuals (v) the creditable protection position of just about every prescription drug solution and (vi) the complete selection of Medicare-qualified people today coated by each option (fewer the number of Medicare Portion D men and women, if any, being claimed below the Retiree Drug Subsidy Plan).

In addition to the higher than, if a plan’s prescription drug coverage is terminated or if there is a change in the plan’s creditable protection position, the employer ought to update its CMS disclosure within just 30 times.

HIPAA—Breach Report to OCR

Employer group well being plans are “lined entities” underneath HIPAA and must report breaches of unsecured secured wellbeing details to the Business of Civil Rights (OCR) with the Office of Health and Human Expert services. As related listed here, the program need to report small breaches developing in 2021 no afterwards than March 1, 2022. (A “small” breach is one particular affecting 500 or fewer individuals.) For a self-funded employer team wellness approach, it is the employer’s obligation to make certain that the report is built in a timely manner, however the report may perhaps truly be submitted by a business associate, these kinds of as the plan’s third-social gathering administrator. The report must be submitted electronically on the OCR site.

As a reminder, in addition to the over, the program have to notify influenced folks of a HIPAA breach inside 60 days of the breach currently being learned. If the HIPAA breach is substantial (affects additional than 500 people), then in addition to notifying impacted people, the prepare have to notify HHS within 60 times of discovery. If the HIPAA breach affects more than 500 people today within just a one state, then in addition to the above, the approach have to report the breach to outstanding media stores serving that state in 60 times of discovery.