HIPAA Privacy Rules and Compliance for Self-Funded Plans and Third-Party Administrators
Prohibited Disclosures, Restrictions, Obligations of Regulated Entities, Reviewing and Updating Notice of Privacy Practices
About the Course
Introduction
This CLE webinar will provide plan sponsors and counsel an in-depth analysis of HIPAA privacy rules and regulations for self-funded plans and third-party administrators. The panel will discuss the requirements for regulated entities and under what circumstances they are prohibited from disclosing healthcare information.
Description
Health plans and administrators must balance the privacy concerns of patients with the need to protect patients. Covered entities and business associates under HIPAA must consider HIPAA and other privacy law obligations in light of increased focus on self-funded plans.
HIPAA-covered entities include self-funded employee benefit plans and may administer the plans themselves or engage a third-party administrator. Applying HIPAA rules to these entities is complex and may vary depending on how the plan is structured.
On Apr. 23, 2026, the U.S. Department of Health and Human Services (HHS) Office for Civil Rights (OCR) announced HIPAA privacy and security enforcement actions against a self-funded employee benefit plans. The initiative emphasizes their position that self-funded plans, and not just their third-party administrators, are directly accountable for HIPAA compliance, with limited exceptions. These exceptions are often narrow, and counsel must understand when an exception applies and when it does not. This can cause various compliance issues for self-funded plans and administrators attempting to limit liability and avoid compliance mishaps when handling data, group policies, and access to information.
To comply with health privacy laws while meeting the disclosure needs for public health purposes, plan sponsors and their counsel should have policies and procedures in place to ensure the strict requirements for disclosure are met.
Listen as our panel examines HIPAA and other privacy laws as applied to self-funded plans and third-party administrators.
Presented By
Ms. Gordy is a trusted strategist, partnering with clients to understand their operational needs, reputational concerns and regulatory risk. She was cybersecurity counsel for two of the largest healthcare cyberattacks in recent years, leading crisis management, forensic analysis, patient notification and regulatory defense. Ms. Gordy helps clients transform their cybersecurity programs, improve regulatory compliance and foster incident response readiness. Whether advising retail pharmacies on cybersecurity risk management or energy companies on their privacy obligations, she works with stakeholders to perform technical testing, policy review and employee training.
Ms. Kiesewetter has more than 24 years of experience advising businesses in ERISA, employee benefits, compensation, fiduciary responsibility, and compliance matters. As a member of the firm’s Employee Benefits and Tax Practice in Nashville, she advises clients on all aspects of employee benefits and executive compensation, including qualified and nonqualified retirement plans, health and welfare benefit plans, cafeteria plans, severance plans, and equity-based compensation plans. Ms. Kiesewetter has advised companies, governmental entities, plan sponsors, plan administrators, human resources professionals, and fiduciaries regarding employee benefit plan compliance (both ERISA and non-ERISA). She also has served as a retirement plan compliance consultant at a national brokerage where she supported both external clients and internal retirement plan advisors and consultants, helping to complement organizations’ benefits, compensation, and overall people programs. Ms. Kiesewetter has also worked with businesses and investors during mergers and acquisitions, focusing on due diligence and compliance related to employee benefit plans, including retirement, health and welfare, and executive compensation plans. Additionally, she has worked on many post-acquisition employee benefit matters, specifically related to plan compliance and correction. Ms. Kiesewetter is a frequent speaker and author on topics including ERISA, employee benefits, retirement plans, health plans, and statutory and regulatory compliance.
-
This 90-minute webinar is eligible in most states for 1.5 CLE credits.
-
Date + Time
- event
Tuesday, December 1, 2026
- schedule
1:00 PM ET/10:00 AM PT
I. HIPAA regulations
II. Risks for self-funded plans and ensuring compliance
III. Third-party administrator duties and associated risks
IV. Covered entities that are also TPAs
V. Minimizing liability
The panel will review these and other key issues:
- What are "covered entities" under HIPAA?
- What are the top risks facing entities handling health information?
- How can self-funded plan sponsors and administrators ensure compliance with HIPAA?
- What are the risks and compliance pitfalls for covered entities also acting as TPAs?
Related Courses
HIPAA Privacy Rules and Compliance for Self-Funded Plans and Third-Party Administrators
Tuesday, December 1, 2026
1:00 PM ET/10:00 AM PT
Structuring Pension, Health, and Welfare Plans for Multinational Companies
Available On-Demand
