ACA and HIPAA are separate laws with different enforcement agencies and different scopes. But for anyone building or operating within benefits administration, they create overlapping obligations that must be managed together, not in parallel silos.
This guide breaks down both laws, explains where they intersect, and provides a practical compliance framework for employers and the platforms that power them.
TL;DR
- ACA (2010): Requires employers with 50+ full-time employees to offer affordable, adequate health coverage — or pay escalating penalties
- HIPAA (1996): Protects individually identifiable health information (PHI) held by covered entities and their business associates
- The overlap: ACA expanded HIPAA's Administrative Simplification provisions, creating overlapping compliance obligations across benefits data, wellness programs, and electronic health transactions
- The stakes: Healthcare data breaches average $9.77M per incident — the highest of any industry for 14 consecutive years
Understanding ACA and HIPAA: Key Definitions and Scope
What Is the Affordable Care Act (ACA)?
The ACA, signed into law in 2010, restructured how health insurance coverage works in the United States across four main pillars: the employer mandate, health insurance marketplaces, Medicaid expansion, and protections for pre-existing conditions.
For employers, the central obligation is the Employer Shared Responsibility provision. Applicable Large Employers (ALEs) (organizations with 50 or more full-time or full-time equivalent employees in the prior calendar year) must offer Minimum Essential Coverage (MEC) that meets two thresholds:
- Minimum value: The plan covers at least 60% of total allowed costs
- Affordability: Employee premium contributions don't exceed the IRS-specified percentage of household income (9.02% for 2025 plan year; rising to 9.96% for 2026 under Rev. Proc. 2025-25)
ALEs that fail these thresholds face Employer Shared Responsibility Payment (ESRP) penalties assessed by the IRS.
What Is HIPAA?
HIPAA, passed in 1996, established national standards for protecting Protected Health Information (PHI): individually identifiable health information created, received, maintained, or transmitted by covered entities and their business associates. Notably, employer-sponsored group health plans — the same plans subject to ACA mandates — qualify as HIPAA-covered health plans under 45 CFR 160.103.
Covered entities include health plans, healthcare providers, and healthcare clearinghouses. Business associates are vendors or platforms that handle PHI on behalf of covered entities, such as benefits administration platforms and HR tech companies that process enrollment and eligibility data.
HIPAA's compliance framework rests on four rules:
| Rule | What It Covers |
|---|---|
| Privacy Rule | Individual rights to access PHI; limits on use and disclosure |
| Security Rule | Administrative, physical, and technical safeguards for electronic PHI |
| Breach Notification Rule | Required notifications when unsecured PHI is compromised |
| Transactions & Code Sets (Administrative Simplification) | Standardized formats for electronic health data exchange |
How ACA and HIPAA Intersect
These two laws weren't designed as a pair — but they create overlapping obligations at several key points.
Administrative Simplification
HIPAA's original Administrative Simplification provisions (Title II, Subtitle F) mandated standardized formats for electronic healthcare transactions. ACA Section 1104 expanded this framework by requiring uniform operating rules for eligibility verification, claims status inquiries, and electronic funds transfers. For benefits platforms and TPAs, this means a single transaction infrastructure must comply with both the original HIPAA standards and the ACA's expanded operating rules — failure on either triggers separate compliance exposure.
Wellness Program Obligations
Health-contingent wellness programs sit at the regulatory crossroads of both laws. Under HIPAA's nondiscrimination rules (45 CFR 146.121), programs tying rewards to health status must meet five requirements:
- Offer the opportunity to qualify at least once per year
- Cap rewards at 30% of employee-only coverage cost (50% for tobacco cessation programs)
- Be reasonably designed to promote health — not serve as a pretext for discrimination
- Provide a reasonable alternative standard for those who can't meet the initial requirement
- Disclose the alternative standard in all program materials
Under the ACA, affordability calculations treat wellness incentives differently based on type. The affordability test assumes employees fail to earn non-tobacco incentives (they pay the higher premium) but do earn tobacco-related incentives. A wellness program that clears all five HIPAA criteria can still cause an ACA affordability failure if the base premium exceeds the applicable threshold. That means clearing HIPAA's five-factor test is necessary — but not sufficient. ACA affordability math must run in parallel, using different assumptions for each incentive type.
Benefits Data as PHI
ACA reporting requires collecting detailed coverage data — enrollment status, effective dates, dependent records, affordability codes. When this data flows through the group health plan function, it constitutes PHI under HIPAA. Any platform handling both ACA reporting and benefits administration is simultaneously a HIPAA business associate and an ACA compliance service provider.
The boundary hinges on function, not data type:
- Employer-capacity records (held in HR/payroll systems) — not PHI, regardless of what fields they contain
- Group health plan records (the same fields, accessed through plan administration) — PHI, subject to full HIPAA protections
HR tech platforms must maintain clear architectural separation between these two data contexts. A single data store shared across HR and plan functions erases that line — and with it, the compliance boundary.
This distinction directly shapes how benefits platforms should design their data models and BAA scope when connecting to HRIS systems for ACA-related reporting.
ACA Compliance Requirements for Employers
The Employer Mandate
Applicable Large Employers (ALEs) must offer Minimum Essential Coverage (MEC) to at least 95% of full-time employees and their dependents. Full-time means averaging 30+ hours per week or 130+ hours per month, regardless of how the employer classifies the worker internally. This includes:
- Seasonal workers
- Variable-hour employees measured over a look-back period
- Non-traditional workers who meet the hour threshold
Penalty exposure under Section 4980H:
| Penalty Type | Trigger | 2025 Annual Amount | 2026 Annual Amount |
|---|---|---|---|
| 4980H(a) — "Penalty A" | Fail to offer MEC to 95% of full-time employees | $2,900 per FTE (minus first 30) | $3,340 per FTE (minus first 30) |
| 4980H(b) — "Penalty B" | Coverage offered is unaffordable or below minimum value | $4,350 per affected employee | $5,010 per affected employee |
Penalties are assessed per employee who receives a premium tax credit on the Marketplace. The IRS initiates enforcement through Letter 226J, giving employers an opportunity to respond before formal assessment.
Reporting Obligations
Penalty exposure only materializes if the IRS can identify non-compliance — which is why accurate, on-time reporting is the other half of the equation. ALEs must file Forms 1094-C and 1095-C annually, even when employees waive coverage. For the 2025 tax year:
- Furnish Form 1095-C to employees: March 2, 2026
- Electronic filing with IRS: March 31, 2026
- Electronic filing is mandatory for organizations submitting 10 or more returns
Late or inaccurate filings carry a separate penalty of $330 per return, with a maximum of $3,987,000 for large filers. This penalty runs independently of any Employer Shared Responsibility Payment (ESRP) liability — meaning an employer can face both simultaneously.
State-Level Reporting
Five jurisdictions enforce individual mandates with separate reporting requirements beyond federal Forms 1094-C/1095-C:
- California — Report MEC to FTB by March 31, 2026
- New Jersey — Requires 1095-C with Parts I and III completed (Part II alone is insufficient)
- Massachusetts — Form 1099-HC plus ACA forms
- Rhode Island and Washington, D.C. — Accept federal forms with state-specific submission
The requirements aren't uniform: New Jersey's Part III requirement catches many multi-state employers off guard.
HIPAA Compliance in Benefits and HR Tech
Who HIPAA Covers — and Why Vendors Are Included
Covered entities (health plans, providers, clearinghouses) have always been HIPAA's primary subjects. But the business associate category extends those obligations to every vendor that creates, receives, maintains, or transmits PHI on their behalf.
For benefits administration, this means:
- Benefits enrollment platforms processing plan selections
- HR tech companies syncing eligibility data from HRIS systems
- TPAs handling claims and enrollment records
- Carriers receiving 834 enrollment files
Each relationship requires a signed Business Associate Agreement (BAA) specifying permitted PHI uses and requiring appropriate safeguards. The 2013 Omnibus Rule extended direct HIPAA liability to business associates — they're not just contractually bound, they're independently subject to enforcement.
Security Rule Requirements
The Security Rule mandates three categories of safeguards for any system handling electronic PHI:
Administrative safeguards (45 CFR 164.308):
- Documented risk analysis and risk management program
- Workforce training and security awareness
- Access management policies and procedures
Physical safeguards (45 CFR 164.310):
- Facility access controls
- Workstation security policies
- Device and media controls
Technical safeguards (45 CFR 164.312):
- Access controls with unique user identification
- Audit controls and activity logging
- Transmission security (encryption)
- Integrity controls to prevent unauthorized PHI alteration
Breach Notification Timelines
When unsecured PHI is compromised, covered entities must:
- Notify affected individuals within 60 days of discovery
- Notify HHS — immediately for breaches affecting 500+ individuals
- Notify prominent media outlets for breaches affecting 500+ individuals in a single state
Business associates must notify covered entities within 60 days of discovery. Breaches affecting 500+ individuals are published publicly on the HHS Breach Portal.
The financial exposure is substantial. HHS OCR has collected $142.6 million through 147 enforcement settlements since 2003, with 32,431 corrective action cases resolved. Healthcare data breaches average $9.77M per incident — well above the cross-industry average of $4.88M.
How Bindbee Addresses HIPAA Obligations for Benefits Platforms
That breach exposure risk multiplies fast for benefits platforms managing dozens of HRIS integrations — each new connection is a new potential PHI vulnerability. Benefits platforms pulling enrollment, eligibility, and dependent data across 60+ HRIS systems need compliance infrastructure built into the integration layer, not bolted on afterward.
Bindbee addresses this directly. As a HIPAA-compliant unified API, it maintains security controls at the integration layer itself. Under its BAA framework, Bindbee acts as a business associate, committing to process PHI only as necessary to perform services and report any security incident within 72 hours of discovery.
The platform's security architecture includes:
- Encryption for data in transit (TLS/HTTPS) and at rest
- MFA and SSO authentication with least-privilege access controls
- Audit trails with SOC 2 and HIPAA-ready event-level logging across all API connections
- Custom field controls enabling benefits platforms to retrieve only the specific data elements required — supporting the HIPAA minimum necessary standard
For benefits platforms that must demonstrate vendor security diligence to plan sponsor clients, Bindbee's SOC 2 Type II and ISO 27001 certifications serve as audit-ready documentation — so engineering teams aren't rebuilding compliance evidence for every enterprise deal.
Practical Steps to Stay Compliant with Both ACA and HIPAA
Neither ACA nor HIPAA compliance is a one-time setup. Both require ongoing operational discipline.
Baseline Compliance Checklist
ACA obligations:
- Confirm ALE status annually (headcount from prior calendar year)
- Update affordability safe harbor calculations for the current plan year threshold
- Audit employee classification — flag workers averaging 30+ hours/week regardless of title
- Verify Forms 1094-C/1095-C processes before filing deadlines
- Identify state-level reporting obligations for all operating jurisdictions
HIPAA obligations:
- Conduct or update risk assessments (HHS recommends ongoing reviews tied to organizational change, not fixed calendar intervals)
- Confirm BAAs are in place with all vendors handling PHI — including benefits platforms, TPAs, and enrollment systems
- Review access controls for group health plan data; ensure employment records and plan data are segregated
- Verify breach notification procedures and response timelines are documented
The Data Quality Problem That Creates Dual Exposure
Stale or incomplete benefits data creates simultaneous ACA and HIPAA risk. A termination event not captured promptly means:
- An employee may receive COBRA notice too late (ACA and ERISA obligation)
- Coverage data in the plan system is inaccurate (HIPAA integrity obligation)
- ACA reporting reflects incorrect coverage months (Form 1095-C accuracy obligation)
Real-time data infrastructure eliminates this lag. Webhook-based event detection captures terminations, dependent changes, and status updates directly from the source HRIS — closing the 30-90 day reconciliation gap that drives most downstream compliance errors.
Newfront reduced integration time from 12 weeks to 48 hours using Bindbee's unified API, replacing spreadsheet-based reconciliation with real-time dependent and eligibility verification.
When to Involve Legal Counsel
Most operational obligations stay within compliance teams. These situations call for qualified legal counsel:
- Wellness program design — requires both HIPAA nondiscrimination analysis and ACA affordability modeling
- State mandate obligations — requirements vary significantly by jurisdiction, and some (like New Jersey's Part III requirement) are easy to miss
- Plan document amendments — required when plan sponsors need access to PHI for administrative purposes
- Annual policy reviews — regulations evolve; 2026 brings both a higher affordability threshold (9.96%) and higher ESRP penalty amounts
Frequently Asked Questions
How does the ACA affect HIPAA?
The ACA expanded HIPAA's Administrative Simplification provisions by requiring uniform operating rules for electronic health transactions (eligibility, claims, EFT) and reinforced HIPAA's privacy framework. The two laws are complementary: ACA built directly on HIPAA's privacy and security foundation rather than replacing it.
Who must comply with both ACA and HIPAA?
Employers with 50+ full-time employees must comply with ACA. HIPAA applies to covered entities (health plans, providers, clearinghouses) and their business associates. Many large employers are subject to both because their sponsored group health plans qualify as HIPAA-covered entities under 45 CFR 160.103.
What is the employer mandate under the ACA?
Applicable Large Employers must offer Minimum Essential Coverage meeting affordability and minimum value standards to full-time employees, or face ESRP penalties under Section 4980H. They must also report coverage offers annually via IRS Forms 1094-C and 1095-C, regardless of employee enrollment decisions.
What are the penalties for ACA non-compliance?
Section 4980H creates two penalty tracks: Penalty A ($3,340/employee annually for failing to offer MEC to 95% of full-time employees) and Penalty B ($5,010/employee annually for coverage that's unaffordable or inadequate) — 2026 figures. Late or inaccurate IRS filings carry separate penalties of $330 per return, capped at $3.99M.
Does HIPAA apply to employee health records held by an employer?
Employment records held in the employer's HR capacity are explicitly excluded from PHI under 45 CFR 160.103. The same data, when accessed through the group health plan function — claims records, enrollment data, eligibility information — is PHI and subject to full HIPAA protections.
What is HIPAA Administrative Simplification?
Administrative Simplification — established in HIPAA Title II and expanded by ACA Section 1104 — mandates standardized electronic transaction formats and operating rules for healthcare data exchange. It covers eligibility verification, claims processing, EFT, and remittance advice across health plans and providers.
