Plan Nondiscrimination and HIPAA Privacy: Small Employer Basics

Two sets of rules shape how a small employer's health plan treats people. Nondiscrimination rules limit how a plan can treat employees differently, whether based on their health or in favor of owners and top earners. Privacy rules limit who can see the health information that runs through the plan, and what they can do with it.

Both apply to small businesses, and both are easy to break with good intentions. Asking about an employee's health history at enrollment or sharing claims details with a manager are two common examples. This guide covers the basics, using guidance from the U.S. Department of Labor (DOL), the Department of Health and Human Services (HHS) and the IRS.

This is general information, not legal advice. For questions about your plan, contact the DOL's Employee Benefits Security Administration (EBSA) at 1-866-444-3272 or a benefits attorney. For questions about insured plan rates and state rules, contact your state insurance department.

HIPAA's health-factor nondiscrimination rules

Under HIPAA, a group health plan can't deny eligibility or benefits based on a "health factor," and can't charge someone more than similarly situated people because of one. The DOL lists eight health factors:

• health status
• medical conditions, including physical and mental illnesses
• claims experience
• receipt of health care
• medical history
• genetic information
• evidence of insurability
• disability

The DOL's examples show where the lines fall. A plan can't make anyone pass a physical exam to enroll. It can't postpone a dependent's eligibility because the dependent is in the hospital. It also can't score health questionnaires to keep people out. A plan can use an enrollment questionnaire, according to the DOL, but only if it doesn't ask for genetic information, including family medical history, and the answers aren't used to deny, restrict or delay eligibility or benefits, or to set individual premiums. The DOL also counts conditions arising from domestic violence, and hobbies such as motorcycling or skiing, as evidence of insurability, so they can't be used to deny enrollment or charge more.

Who counts as "similarly situated"

HIPAA lets plans treat groups differently if the groups are based on "bona fide employment-based classifications" consistent with the employer's usual business practice. The DOL's examples include full-time and part-time employees, employees in different locations, and employees with different hire dates or lengths of service. Plans can also distinguish between employees and dependents, and between spouses and children.

The DOL puts the principle this way: the protections apply within a group of similarly situated people, not across groups. In its example, an employer can charge part-time employees more than full-time employees, but all full-time employees must pay the same rate regardless of health status.

The DOL also notes that HIPAA allows an insurer to charge one employer's plan more than another's based on the group's collective health. The ACA's small-group rating rules and state law may limit that for insured plans, so ask your state insurance department how rates work where you are.

Wellness programs that tie a reward to a health outcome or activity have their own requirements. The DOL's Reporting and Disclosure Guide says plan materials that describe a health-contingent wellness program must disclose that a reasonable alternative standard is available, or that the standard may be waived.

Tax rules against favoring owners and top earners

Separate tax rules stop plans from tilting toward the people at the top. IRS Publication 15-B (2026) describes two that small employers run into most:

• Self-insured medical reimbursement plans. If such a plan favors highly compensated employees, some or all of what it pays them must be included in their Form W-2 wages. For this rule, the IRS defines a highly compensated employee as one of the five highest-paid officers, an employee who owns more than 10 percent of the employer's stock, or anyone among the highest-paid 25 percent of employees. The IRS describes a self-insured plan as one that reimburses medical expenses not covered by an insurance policy.
• Cafeteria plans. A Section 125 plan that favors highly compensated or key employees loses part of its tax advantage for them. Our guide to Section 125 cafeteria plans covers those tests and the "simple cafeteria plan" safe harbor for small employers.

Before you set different contribution levels or eligibility rules for owners, managers and staff, have a tax professional check the design against these rules.

HIPAA privacy: the employer is not the plan

HIPAA's Privacy Rule applies to "covered entities," which include health plans, and employer-sponsored group health plans count. HHS lists one exception: a group health plan with fewer than 50 participants that is administered solely by the employer that set it up is not a covered entity.

The employer itself usually is not covered. HHS says that "in most cases, the Privacy Rule does not apply to the actions of an employer." It also says employment records a covered entity keeps as an employer are not protected health information. An employer may ask an employee for a doctor's note or other health information when it needs it for sick leave, workers' compensation, wellness programs or health insurance. However, HHS says a health care provider can't give the employer that information directly without the employee's authorization, unless another law requires it.

What the plan may share with you as sponsor

The HHS summary of the Privacy Rule explains what a group health plan or its insurer may give the employer that sponsors it:

1. Enrollment and disenrollment information.
2. Summary health information, if the sponsor asks for it to get premium bids or to modify, amend or end the plan. This means claims history or experience with identifiers stripped out except a five-digit ZIP code.
3. Fuller protected health information for plan administration, but only after the plan document has been amended to restrict its use and the sponsor certifies the change. One required restriction is that the sponsor won't use the information "for any employment-related action or decision" or for any other benefit plan.

HHS notes a lighter load for fully insured plans that receive only enrollment data and summary health information. Their only administrative obligations are the ban on retaliation and on requiring people to waive their rights, plus documentation requirements if plan documents are amended for this kind of disclosure. Plans outside that exception, which include many self-insured plans, face the Rule's full administrative requirements. HHS says those include designating a privacy official and training workforce members.

For example, imagine a 30-person design studio whose owner hears about an employee's diagnosis from a claims report. The safest habit is never to request or keep individual claims details at all. Rely on enrollment data and summary reports, and keep benefits paperwork out of personnel files and away from people who make hiring or firing decisions.

Key takeaways

• HIPAA bars group health plans from setting eligibility, benefits or individual premiums based on eight health factors. Plans can still treat bona fide employment groups, like full-time and part-time staff, differently.
• Enrollment questionnaires can't ask for genetic information, and their answers can't be used to deny or price coverage.
• Self-insured reimbursement plans and cafeteria plans that favor highly compensated employees lose tax benefits for those employees.
• The HIPAA Privacy Rule generally covers the health plan, not the employer, and protected health information from the plan can never drive employment decisions.
• Fully insured plans that receive only enrollment data and summary health information have the lightest privacy obligations.

Sources

• U.S. Department of Labor, EBSA, FAQs on HIPAA Portability and Nondiscrimination Requirements for Workers
• U.S. Department of Labor, EBSA, Reporting and Disclosure Guide for Employee Benefit Plans (December 2022)
• Internal Revenue Service, Publication 15-B (2026), Employer's Tax Guide to Fringe Benefits
• U.S. Department of Health and Human Services, Summary of the HIPAA Privacy Rule
• U.S. Department of Health and Human Services, Employers and Health Information in the Workplace