The more I look beyond the mega-issues affecting employers in the new economic stimulus package, the more I see to worry finance executives.

For instance, the Health Insurance Privacy and Portability Act (HIPPA) of 1996 will be affected in a way that few saw coming. The new law extends direct enforcement of medical record privacy to any person or entity that could be defined as a business associate, including benefits consultants, third-party administrators and wellness program advisors. The original law didn’t require notification of individuals whose medical records are jeopardized in a security breach, whether it be electronic or paper; it was left to the discretion of “covered entities” — usually employers or health insurers — to decide whether or not to notify plan members.

Employers that don’t have direct access to employee health information don’t need to be concerned about the heightened privacy law. Perhaps a bigger concern is the provision that grants state attorneys general HIPPA enforcement authority; some say it could lead to more litigation over violations.

Chris Angar, president, Apgar & Associates, in Portland, OR, told HcPro, a health care consulting company, that the department of Health and Human Services will be required to post a report annually listing all covered entities and business associates that have been fined by HHS, issued corrective action plans, or provided technical assistance to correct a violation.

Time will tell how much the change in law will affect businesses’ relationships with health care vendors and other entities with whom they contract for various health plan-related services. Meanwhile, finance executives should be working with their benefits department to ensure that contracts with such entities are iron-clad. ###