Notice 2008-23 provides a safe harbor for supplemental group health insurance to be considered excepted from the requirements that generally apply under HIPAA. It is expected that the standards of this safe harbor will be incorporated as requirements (rather than just as a safe harbor) in future proposed regulations.
Safe Harbor Standards
Supplemental health insurance under a group health plan will be considered to be an excepted benefit under HIPAA if it is provided through a policy, certificate, or contract of insurance separate from the primary coverage under the plan and if it satisfies all of the following requirements:
(1) Independent of Primary Coverage. The supplemental policy, certificate, or contract of insurance must be issued by an entity that does not provide the primary coverage under the plan. For this purpose, entities that are part of the same controlled group of corporations or part of the same group of trades or businesses under common control, within the meaning of section 52(a) or (b) of the Code, are considered a single entity.
(2) Supplemental for Gaps in Primary Coverage. The supplemental policy, certificate, or contract of insurance must be specifically designed to fill gaps in primary coverage, such as coinsurance or deductibles, but does not include a policy, certificate, or contract of insurance that becomes secondary or supplemental only under a coordination-of-benefits provision.
(3) Supplemental in Value of Coverage. The cost of coverage under the supplemental policy, certificate, or contract of insurance must not exceed 15 percent of the cost of primary coverage. Cost is determined in the same manner as the applicable premium is calculated under a COBRA continuation provision.
(4) Similar to Medicare Supplemental Coverage. The supplemental policy, certificate, or contract of insurance that is group health insurance coverage must not differentiate among individuals in eligibility, benefits, or premiums based on any health factor of an individual (or any dependent of the individual).