Compliance, General

HIPAA Nondiscrimination Rules 101

by GBS Benefits
April 2, 2026
10:22 am

Health Benefits Compliance

HIPAA Nondiscrimination Rules 101

The Health Insurance Portability and Accountability Act of 1996 (HIPAA) is a federal law designed to improve the portability and continuity of health coverage, protect individuals’ health information, and establish national standards for electronic healthcare transactions. While HIPAA may be most widely known for its privacy and security provisions, it is a broad statute divided into multiple titles addressing issues such as fraud and abuse and certain tax provisions, and only certain portions directly impact employer-sponsored group health plans.

For group health plans, the most relevant provisions include the portability and nondiscrimination rules (Title I), which limit eligibility and benefit discrimination based on health factors; special enrollment rights requirements; and the Administrative Simplification provisions (Title II), which include the HIPAA Privacy, Security, and Breach Notification Rules governing the use and protection of protected health information (PHI). Together, these provisions establish key compliance obligations for plan sponsors and administrators while protecting participants’ access to coverage and safeguarding their health information.

This article focuses on the HIPAA nondiscrimination rules, which prohibit group health plans from establishing benefit eligibility and cost distinctions based on individuals’ health factors.

HIPAA Nondiscrimination

There are no laws requiring plans to provide the same benefit coverage to all employees. Generally, employers have discretion when structuring their benefits plans and can make distinctions among employee populations regarding eligibility, cost and the level of benefits offered. However, if making any distinctions, an employer must navigate several non-discrimination rules, including (but not limited to) the HIPAA non-discrimination rules.

HIPAA non-discrimination rules prohibit assessing health insurance premiums based on a health factor(s). These rules are found in Public Health Service Act (PHSA) § 2705 (as added by HIPAA; now incorporated into ACA reforms and incorporated by reference into ERISA § 702 and Internal Revenue Code § 9802. Under these rules, group health plan may not:

Establish eligibility rules based on a health-factor
Require an individual to pay a higher premium or contribution than a similarly situated individual based on a health factor. “Health factor” includes:
- - Health status
  - Medical condition (physical or mental)
  - Claims experience
  - Receipt of health care
  - Medical history (from prior health records)
  - Genetic information
  - Evidence of insurability (includes conditions arising from acts of domestic violence or participation in activities such as skiing, motorcycling, or horseback riding)
  - Disability (physical or mental)

Prior to the HIPAA nondiscrimination and “health factor” rules, it was common for a group health plan to delay an individual’s effective date of coverage if the individual was confined to a hospital or medical facility at the time they became eligible, or if an employee was not “actively at work” on the date coverage would start (even if the employee was merely home sick had taken a personal leave day). This is no longer allowed under HIPAA nondiscrimination rules. Nor may a health plan increase premiums for such individuals.

HIPAA does, however, allow an employer to structure benefits eligibility or premiums differently based on bona fide employment classifications, which the DOL has said might include:

Part-time and full-time employment
Different geographic locations
Different occupations
Different dates of hire or lengths of service
Membership in a collective bargaining unit Exempt or non-exempt employment status

The above classifications must be based on legitimate employment criteria, consistent with the employer’s usual business practices, and applied consistently in accordance with HIPAA’s health status nondiscrimination rules.

Note that the nondiscrimination rules do not prohibit a plan from establishing more favorable rules for eligibility or premium rates for individuals with an adverse health factor, such as a disability. HIPAA also allows a plan to distinguish between employees and dependents when it comes to eligibility and premium cost, and to distinguish between different categories of beneficiaries if the distinction is not based on a health factor. For example, HIPAA allows an employer to offer a group health plan only to employees but not to spouses, or only to employees and spouses but not to dependent children. Or a plan can distinguish between dependent children age 26 and older based on their age or student status.** ¹²

Additional Nondiscrimination Rules

The rules described above apply specifically to HIPAA’s health-factor nondiscrimination requirements. However, a plan design that complies with HIPAA is not automatically compliant with all other applicable federal or state laws that prohibit discrimination.

Employers should evaluate benefit eligibility, cost and design decisions in light of other federal requirements, including the nondiscrimination provisions under the Affordable Care Act (ACA) and the Internal Revenue Code (IRC). For example, distinctions that favor executive or highly compensated employees over other employees

may raise compliance concerns under tax-based nondiscrimination rules, including those applicable to cafeteria plans under IRC § 125, self-insured medical reimbursement plans under IRC § 105(h), employer HSA contributions under IRC § 223, and dependent care assistance programs under IRC § 129, even if the arrangement complies with HIPAA nondiscrimination rules.

In addition, benefit design decisions should be reviewed for potential implications under broader employment discrimination laws, such as Title VII of the Civil Rights Act, the Americans with Disabilities Act (ADA), the Age Discrimination in Employment Act (ADEA), and pregnancy discrimination laws. For example, parental leave benefits that are not tied to pregnancy-related medical conditions generally must be provided on an equal basis to men and women under Title VII and the Family and Medical Leave Act (FMLA).

Also, remember that for insured plans, state law may govern rates for health coverage, and state employment and nondiscrimination laws may impact plan eligibility and cost provisions.

This example is taken from the DOL FAQs, see specifically page 5 .
Note also that although HIPAA does not allow a plan to exclude an employee from the plan or to charge a higher premium because the employee engages in a “high-risk” activity such as bungee jumping, HIPAA does not prohibit a plan from excluding coverage for injuries in connection with an activity like bungee jumping. See FAQs at page 6 .