March brings a number of important deadlines for employers who sponsor a group health plan for their employees.
- February 28, 2018 is the deadline for large employers and employers with self-funded plans to file certain Affordable Care Act forms with the IRS, if the employer is filing on paper and not electronically. (If filing electronically, the deadline is April 2, 2018).
- March 1, 2018 is the deadline for employers to file their Medicare Part D creditable coverage information with CMS.
- March 1, 2018 is the deadline for the health plan to report small HIPAA breaches occurring in 2017.
- March 2, 2018 is the deadline for large employers, and employers with self-funded health plans, to provide certain Affordable Care Act forms (Form 1095-C or Form 1095-B) to individuals.
Affordable Care Act (ACA)
Reporting by Applicable Large Employers (ALEs). In general terms, an employer is an ALE for 2017 if it averaged 50 or more full-time equivalent employees during 2016. An ALE must provide a Form 1095-C to any employee who was full-time for any month in 2017. (For these purposes, "full-time" is as defined by the ACA!) The Forms must be postmarked or provided by March 1, 2018. An ALE must also file a copy of the Forms 1095-C, together with a Form 1094-C, with the IRS. For electronic filers, the deadline is April 2, 2018. For paper filers, the deadline is February 28, 2018. (Paper filing is permitted only for employers with fewer than 250 Forms 1095-C.)
Reporting by Employers Offering a Self-Funded Group Health Plan. If the employer is an ALE, it must provide either a Form 1095-C or a Form 1095-B to individuals (other than full-time employees) who were covered by the plan in 2017. Smaller employers must provide the Form 1095-B to individuals (full-time or part-time, employees or non-employees) who were covered by the plan in 2017. The deadline for providing these forms is March 2, 2018. Employers who provide Forms 1095-B must file copies of those forms, together with the Form 1094-B, with the IRS. For electronic filers, the deadline is April 2, 2018. For paper filers, the deadline is February 28, 2018. (Paper filing is permitted only for employers with fewer than 250 Forms 1095-C.)
Medicare Part D
An employer with a group health plan that provides prescription drug coverage to Medicare-eligible individuals must make an annual disclosure to the Centers for Medicare & Medicaid Services (CMS). The disclosure is due 60 days after the beginning of the plan year—March 1, 2018 for calendar-year plans. Employers must complete and submit the annual CMS disclosure on the CMS website.
In order to complete this disclosure, an employer will need to provide the following information: (i) the employer's name, address, federal tax identification number, and phone number; (ii) the name, title, and email address of the person completing the form; (iii) the type of coverage offered; (iv) the total number of prescription drug options available to Medicare-eligible individuals; (v) the creditable coverage status of each prescription drug option; and (vi) the total number of Medicare-eligible individuals covered by each option (less the number of Medicare Part D individuals, if any, being claimed under the Retiree Drug Subsidy Program).
In addition to the above, if a plan's prescription drug coverage is terminated or if there is a change in the plan's creditable coverage status, the employer must update its CMS disclosure within 30 days.
HIPAA Breach Reporting
Employer group health plans are "covered entities" under HIPAA. Under HIPAA, plans must report a "breach" of unsecured protected health information. As relevant here, the plan must report small breaches occurring in 2017 to the U.S. Department of Health and Human Services (HHS) by March 1, 2018. (A "small" breach is one affecting 500 or fewer individuals.) For a self-funded employer group health plan, it is the employer's obligation to ensure that the report is made in a timely manner, though the report may actually be submitted by a business associate, such as the plan's third-party administrator. The report must be submitted electronically on the HHS website.
As a reminder, in addition to the above, the plan must notify affected individuals of a HIPAA breach within 60 days of the breach being discovered. If the HIPAA breach is large (affects more than 500 individuals), then in addition to notifying affected individuals, the plan must also notify HHS within 60 days of discovery. Moreover, if the HIPAA breach affects more than 500 individuals within a single state, then in addition to notifying affected individuals and HHS, the breach must be reported to prominent media outlets serving that state within 60 days of discovery.
Questions?
If you have questions or concerns regarding this client alert, please contact the authors, any member of Venable's Employee Benefits Practice Group, or your regular Venable lawyer.