In the US, an employer-sponsored self-funded health plan can become a covered entity under federal privacy law, creating compliance duties for the plan sponsor.
Unlike fully insured coverage, self-funded plans keep claim risk with the employer, often for control, savings, and claims-data access tied to wellness efforts.
A third-party administrator runs claims, enrollment, appeals, provider coordination, and service, but does not assume claim costs; it handles protected health information.
Because that vendor accesses protected health information, it serves as a business associate, and the plan needs a signed agreement before sharing data.
Plan sponsors can reduce risk by naming privacy leaders, assessing security regularly, training staff, updating plan documents, issuing notices, and auditing vendors.
