We are considering starting an on-site medical clinic where our employees can receive medical care. Can you explain the main employee benefits compliance concerns for such a clinic?
Employers providing access to an on-site medical clinic for their employees have several potential compliance issues to consider, including ERISA, COBRA, HIPAA, the ACA, and the nondiscrimination provisions of the Internal Revenue Code. In addition, when offering medical plans that include a high deductible health plan (HDHP) intended to be paired with a health savings account (HSA), there are HSA eligibility rules to contend with. An on-site clinic can be a terrific benefit for employees, and it is important for employers considering these programs to understand that the design of the program and the benefits offered under it will impact their compliance obligations as plan sponsors. As a general rule, the greater the services provided at the clinic, the greater the compliance concerns. .
Employer on-site clinics can vary widely as to what they offer. A simple clinic that functions only as a first aid station for on-the-job injuries would likely be exempt from all of the concerns raised in this Q&A. However, clinics with more robust benefits – staffed by nurses or physicians, providing on-site pharmacy, health coaching, etc. – are increasingly popular, and the structure of the clinic and financial arrangement between the employer, participants, and the clinic will impact the analysis.
Most on-site clinics will constitute ERISA welfare plans. Clinics fit under ERISA’s welfare plan definition of a “plan, fund, or program…maintained by an employer…for the purpose of providing medical, surgical, or hospital care or benefits, or benefits in the event of sickness….”1 Department of Labor (DOL) regulations, however, provide for an exemption from this definition of welfare plan for certain facilities which are: 1) maintained on the premises of the employer, 2) provide benefits to employees (not including spouses or dependents), and 3) provide treatment only for “minor injuries or illness or rendering first aid in case of accidents occurring during working hours.”2 The DOL has not provided a definition or clarification of the term “minor injuries or illness.”
Most on-site clinics now provide much more than first aid for work accidents or illness and constitute ERISA welfare plans and group health plans. For example, offering preventive services or flu shots at an on-site clinic would make the clinic an ERISA welfare plan since these are medical benefits. As an ERISA welfare plan, there would be a requirement for:
Many employers handle this concern by “bundling” their traditional group health plan with the on-site clinic from a documentation perspective. This bundling, however, can be difficult where employees who do not participate in the employer’s traditional group health plan are allowed to receive services at the on-site clinic. The employer must meet all of ERISA’s disclosure requirements for these employees who have access to the on-site clinic but will not be on the distribution/mailing lists for those enrolled in the traditional group health plan. Finally, ERISA’s fiduciary rules will also apply to the on-site clinic.6
Employers have four different approaches to comply with ERISA:
COBRA generally applies to group health plans, which are defined as plans maintained by an employer to provide health care to individuals who have an employment-related connection to the employer.7 With an exception noted below, COBRA applies to group health plans “whether provided directly or through insurance, reimbursement, or otherwise, and whether or not provided through an on-site facility.”8
There is an exception for employer facilities similar to the exception under ERISA. Here also, to meet the exception the clinic must be located on the premises of the employer. The health care must consist primarily of first aid (note the word “primarily” is absent in the ERISA exception). The care must be provided during the employer’s working hours for treatment of a health condition, illness or injury that occurs during those working hours. Care must be limited to current employees (no dependents and spouses) and employees may not be charged for the care.9
So, essentially, an on-site clinic will not be subject to COBRA if it only provides treatment for employee illnesses or injuries that occur during working hours and if there is no charge for that care. Few on-site medical clinics meet this exception.
Many employers do not fully appreciate the COBRA challenges that on-site clinics present. First, employers need to ensure adequate delivery of COBRA notices. If the on-site clinic is accessible to employees who are not participants in the traditional group health plan, they might be forgotten when it comes time for general or qualifying event COBRA notices. Second, unless the employer offers the on-site clinic only to those who are enrolled in the traditional group health plan and does not charge an additional COBRA premium (or otherwise offers the COBRA coverage for the on-site clinic for free), the employer will need to arrive at a COBRA premium for the clinic. This can be a difficult calculation, and some employers will choose not to charge a COBRA premium for the clinic. One advantage of not charging an additional COBRA premium for the on-site clinic is that this relieves the employer from including the cost of the on-site clinic on employees’ Form W-2 under the ACA reporting requirements for the cost of health care.10
Also, in some instances, if a COBRA beneficiary elects the on-site clinic they will be entitled to enroll in any other COBRA-covered benefits (such as group medical) offered by the employer at the next open enrollment.11 So, if the on-site clinic was offered to employees who were not in the group health plan, the employee could select coverage for the on-site clinic initially and then elect other benefits at a future open enrollment. This could exacerbate the kind of adverse selection that is inherently part of COBRA elections.
Regardless of the approach taken, if the on-site clinic is covered by COBRA, likely the most concerning aspect of the COBRA obligation is the need to provide access for a former disgruntled employee who has elected COBRA coverage. Anecdotal accounts indicate that some employers design their on-site clinics to have a separate door to the outside so these former employees cannot enter any other portion of the building.
An employer has wide discretion to define how many group health plans it maintains for COBRA purposes. The default rule is that all group health benefits will be considered a single plan unless it is clear from the instruments governing the plan that benefits are being provided in separate plans, and they must actually be operated as separate plans.12 So, the default rule would be that the traditional group health plan and the on-site clinic would be a single plan for COBRA purposes. Still, if that is the employer’s intent it would be wise to make that “single plan” designation specifically in its documentation. The result is that if the employer limits the on-site clinic to employees who have elected traditional group health plan coverage, then the employer could require the employee to elect COBRA for the group health plan if the employee wants to access the clinic. This would likely reduce the number of employees who would elect COBRA in order to gain access to the on-site clinic.
From a compliance standpoint, the easiest course of action would likely be to:
On-site clinics are considered “excepted benefits” under HIPAA and are generally exempt from HIPAA’s portability, special enrollment, and nondiscrimination rules based on health status (not to be confused with the Internal Revenue Code’s nondiscrimination rules).14 On-site clinics are also not included in the definition of “health plans” for HIPAA administrative (i.e., privacy and security) provisions.15 But it is important to understand that this only applies to the on-site clinic’s status as a health plan. An on-site clinic could still be covered by HIPAA’s privacy and security rules as a heath care provider.
The clinic would be covered by HIPAA’s privacy and security rules as a health care provider if it conducts “standard transactions” electronically (e.g., billing, payments, coordination of benefits, enrollment, and eligibility) or hires a service provider to perform this function.16 This will turn on the specific facts of each on-site clinic. If the clinic bills the employer’s traditional group health plan for any services then there will undoubtedly be these types of “standard transactions” and the clinic would need to abide by HIPAA privacy and security as a health care provider.
Also, when dealing with protected health information (PHI) the employer should recognize that its traditional group health plan is a covered entity under HIPAA. And while the on-site clinic might not be a covered entity either as a health plan or health care provider, the employer should pay close attention to whether or not the group health plan might inadvertently violate any HIPAA privacy or security provisions for any information the group health plan provides to the clinic. Those disclosures might be fine for treatment at the clinic, but wherever PHI is being disclosed, covered entities such as group health plans should make sure that they fall under an applicable exemption for disclosure.
The on-site clinic should be careful concerning any PHI it discloses to the employer if the on-site clinic is considered a health care provider. As long as certain procedures and documentation are in place, a group health plan as a covered entity can disclose PHI to an employer for purposes of plan administration.17 There is no similar exclusion for a health care provider disclosing PHI to an employer.
Furthermore, some have expressed concerns that an on-site clinic could lose its status as an excepted benefit and/or being exempt from HIPAA’s privacy and security provisions if it is “bundled” with the employer’s traditional group health plan, which is clearly subject to these provisions. As previously discussed, that “bundling” may be a preferred course of action because of ERISA and COBRA compliance concerns. Based on language in the regulatory exclusion that a program is excluded from the definition of a health plan – and therefore HIPAA privacy and security provisions as a group health plan – to the “extent that” it provides for excepted benefits, it may be possible to treat the on-site clinic as separately excluded, even if it is bundled with the traditional group health plan. But, as with every aspect of this Q&A, an employer’s own legal counsel should be consulted on this point.
Of course, if an on-site clinic is subject to the HIPAA privacy and security rules, a myriad of compliance concerns beyond the scope of this Q&A also apply, such as HIPAA policies and procedures, record retention, security and privacy officers, contracts with business associates, reporting security breaches, etc.
Finally, even if the argument can be made that an on-site clinic is exempt from the HIPAA privacy and security rules, there are state laws that could be applicable. Every effort should be made to keep an on-site clinic’s records confidential and to have stringent security policies and procedures in place.
The on-site clinic’s status as an excepted benefit under HIPAA will also exempt the clinic from certain aspects of the ACA. Specifically, the on-site clinic will be exempt from the ACA individual and group market reforms, which some refer to as the PHSA Mandates.18 These reforms include coverage of all preventive services at no cost, no annual or lifetime caps, coverage of children to age 26, etc.19
Employers reporting under Code Sections 6055 and 6056 on Form 1095-C for applicable large employers (ALEs) should not be triggered by the on-site clinic alone, since it is an excepted benefit.20 Of course, most ALEs with on-site clinics also have a traditional group health plan that will require reporting. Relatedly, as an excepted benefit, the on-site clinic is not considered “minimum essential coverage” and offering the on-site clinic alone will not be sufficient to meet the employer mandate.
An on-site clinic will generally be considered a self-insured plan subject to nondiscrimination testing under Code Section 105(h).21 Similarly, Code Section 125 nondiscrimination rules come into play where employees pay for access to an on-site clinic on a pre-tax basis as part of their group health coverage through a Section 125 (cafeteria) plan.22 These rules are designed to ensure that the plan does not discriminate in favor of highly compensated employees/individuals.
Generally, nondiscrimination problems under the Code are unlikely where all employees have access to the on-site clinic or where all employees with traditional group health plan coverage have access to the on-site clinic (and assuming the traditional group health plan satisfies the nondiscrimination rules under Code Section 105(h)). But conceivably, there could be nondiscrimination issues where an employer has an HDHP plan and a non-HDHP plan and, because of the HSA issues discussed subsequently, decides to charge employees in the HDHP fair market value for services before the deductible is met while allowing employees in the non-HDHP to have services free of charge at all levels.
Also, for an employer with several locations but where an on-site clinic is only available at one location, there are potential issues under the Code Section 105(h) eligibility test.23
Many employers offer HDHPs combined with HSAs as a plan design. To be eligible for an HSA, an employee must not only be enrolled in an HDHP but also must not have access to any other disqualifying coverage before the HDHP minimum statutory deductible is met.24
An on-site clinic can constitute disqualifying coverage in many instances, but there are exceptions. First, if the on-site clinic provided only preventive services it would not be considered other disqualifying coverage for purposes of the HSA.25 Also, in Notice 2008-59, Q&A 10, the IRS indicated that an on-site clinic would not destroy an employee’s status as an HSA-eligible individual if the clinic does not provide “significant benefits in the nature of medical care.” The Notice provides an example of an on-site clinic at a manufacturing plant that limited its free services to: (1) physicals and immunizations; (2) injecting antigens provided by employees (e.g., performing allergy injections); (3) a variety of aspirin and other nonprescription pain relievers; and (4) treatments for injuries caused by accidents at the plant. In that instance, the IRS states that the on-site clinic would not be providing significant benefits in the form of medical care. The Notice provides another example of a hospital that provides a full array of services to its employees at the hospital “for all of their medical needs” at no charge. Here, the IRS unsurprisingly found that the clinic would be providing significant benefits in the form of medical care and the employee would therefore be ineligible for an HSA. Of course, almost all on-site clinics would fall in between these two extreme examples. Whether an on-site clinic offers “significant benefits in the nature of medical care” is a facts-and-circumstances determination where the employer’s legal counsel should be consulted. Preventive services can be disregarded when looking to see whether an on-site clinic provides significant services in the nature of medical care.
While Notice 2008-59 does not directly state that an employee will remain HSA-eligible if the employee pays fair market value for services at the on-site clinic before the deductible is met, many suggest that is an implicit part of this guidance.26 That conclusion, however, begs the question of what constitutes fair market value and how is that determined. Possibilities range from a full actuarial study (probably the safest) to what another local clinic/urgent care center is charging. The Medicare rate multiplied by a factor could also be considered. The non-discounted reasonable and customary charges by CPT code is another possibility. Outside the full actuarial study, none of these methods is likely “bullet proof.” If an employer decides to try and charge fair market value as a method of maintaining HSA eligibility, the employer’s counsel should, once again, be consulted.
Although likely not a practical solution, an employer could theoretically bar access to the on-site clinic until the employee has satisfied the HDHP deductible.
In addition, as mentioned above, charging those with an HDHP fair market value while allowing those with non-HDHP coverage to have free access could raise Code Section 105(h) nondiscrimination issues.
Finally, there is some tension between this guidance from the IRS and the notion that the on-site clinic is an ERISA-covered plan. Fair market value would arguably have within it an element of profit. The employer sponsoring the clinic will likely be, in one aspect or another, an ERISA fiduciary of the on-site clinic it is sponsoring. Making a profit off of the plan’s participants and beneficiaries might be viewed by some as inconsistent with ERISA.
On-site clinics can be a very valuable tool for improving employee access to health and wellness services as well as improving productivity. With a healthier population, the employer’s cost of providing group medical benefits should decrease over time. However, an employer should have a detailed strategy for addressing the issues raised in this Q&A considering the potential complexities depending on the way the program is structured, the services offered, and the benefits offered under the traditional group health plan (such as an HDHP).
Authored by McGriff Employee Benefits Compliance Team
References
