The American Recovery and Reinvestment Act of 2009 (ARRA) makes substantial, but temporary, changes to the rules governing the continuation of health coverage under COBRA and a number of other modifications affecting welfare benefit plans.

ARRA aims to make health coverage more affordable for employees who lose their jobs by lowering the cost of COBRA coverage for many individuals. Any qualifying individual whose employment is involuntarily terminated between September 1, 2008, and December 31, 2009, and who is eligible for continuation coverage under COBRA because of the termination will be able to continue health coverage at only 35 percent of the ordinary COBRA premium for up to nine months. Employers (and, in certain cases, insurers) will subsidize the remaining 65 percent, but have the right to recover the subsidy amount from the federal government through a credit on their payroll tax deposits.

Affected Plans. The new subsidy rules apply to plans that are subject to COBRA, certain federal government plans, and plans that are exempt from COBRA but subject to comparable requirements for health coverage continuation under state law. For convenience, this memorandum refers to the continuation of coverage under all of these plans as COBRA coverage. Health flexible spending arrangements provided through a cafeteria plan are exempt from the requirements.

Discount Period . The discount period begins with the first month of coverage after ARRA is signed into law and lasts up to nine months, but may be shorter. ARRA does not extend the maximum period of COBRA coverage beyond its ordinary expiration date. The discount will end when the COBRA coverage itself ends. In addition, the discount will end when an individual becomes eligible for coverage under Medicare or another group health plan (other than a plan that offers certain types of limited benefits, such as a dental plan or health flexible spending account). ARRA applies penalties against individuals who fail to provide appropriate notice when they become eligible for other coverage.

Second Chance to Elect. Those who are eligible for the discount, but who did not previously elect COBRA coverage, must be afforded a period of at least 60 days to elect continuation coverage. The coverage will be effective as of the first day of the month after ARRA is signed into law (March 1). The maximum period for coverage will be measured from when it would have begun if COBRA had been elected when initially offered.

Notice Requirements. Plan administrators must modify or supplement the COBRA notices they provide when a qualifying event occurs. The notice must include specified information regarding the opportunity for a premium discount. Plan administrators must also alert those who have already elected COBRA and those who are eligible for the discount but have not elected COBRA of their rights under ARRA. This notice must be provided within 60 days after ARRA is signed. The government is required to issue model notices within 30 days of that signature.

Corrections. If a claim for a discount or for continuation coverage under ARRA is denied, the claimant has the right to request that the federal government rule on his or her eligibility on an expedited basis. If an individual pays a full premium when the discount should have applied, the individual is entitled to reimbursement of (or credit against future premiums for) the excess payment.

Reimbursement. An employer may obtain reimbursement for its subsidy from the federal government through a reduction in the amount that it deposits in payroll taxes, including wage withholding amounts and FICA contributions (both the employer and employee portions). An employer must file applicable reports to support the reduction. Where payroll taxes are not sufficient to support the amount of the subsidy, a credit or refund will apply. Insurers must follow similar procedures.

Other Rights. The new law provides that employers may allow individuals who qualify for the discount to change coverage to an option that is no more expensive. If an employer chooses to allow these changes, it must notify employees of this opportunity.

Higher-Income Individuals. For individuals who have annual income of more than $125,000 (if single) or $250,000 (if married), some or all of the subsidy will be recaptured through their individual tax filings. Such individuals may permanently elect not to be treated as eligible for the subsidy.

Comments. ARRA does not include provisions found in the House bill that would have vastly expanded the right to continue COBRA coverage for individuals who lose coverage on account of a termination of employment or reduction in hours after attaining age 55 or completing 10 years of service with an employer. The House version would have made this change permanent.  Despite intense debate, these provisions moved swiftly through Congress and leave numerous questions unanswered. We will stay tuned for the model notices and other implementation guidance.

While many employers have been anticipating amendments to the COBRA rules, few would have expected ARRA to make sweeping revisions to HIPAA's privacy and security requirements.  But ARRA makes a number of dramatic changes to these requirements, erasing many of the carefully drawn distinctions between covered entities and business associates with regard to the security rules, and blurring many of them with regard to the privacy rules1. ARRA includes provisions that:

  • impose most of the security requirements that apply to covered entities under HIPAA's security regulations on business associates;

  • specify that the privacy requirements that must be set forth in each business associate agreement apply to the business associates by statute as well as by contract. ARRA also requires a business associate to take action to cure breaches of its business associate agreement by the applicable covered entity (and, if unsuccessful, terminate the agreement or, if termination is not feasible, report the breach to HHS);

  • require business associates to meet all of the new privacy and security requirements that ARRA imposes on covered entities and require business associate agreements to be expanded to reflect these new requirements; 

  • subject business associates to the same penalties that HIPAA applies to covered entities;

  • require the Department of Health and Human Services (HHS) to issue annual guidance (starting in 2010) on the most effective and appropriate technical safeguards for purposes of maintaining the security of protected health information (PHI); 

  • within 60 days of the date the law is signed, require HHS to issue guidance specifying technologies and methodologies that render PHI unusable, unreadable, or indecipherable to individuals and, in the event a covered entity or business associate fails to follow these requirements and the security of PHI is breached, require it to provide written notice to individuals affected by the breach that meets specified requirements. Notice must also be provided to HHS. Other notice obligations may apply depending on the circumstances;

  • introduce particular security and business associate agreement requirements applicable to vendors of personal health records;

  • make various changes to the penalty and enforcement rules applicable to violations of the HIPAA privacy requirements; and

  • make additional changes that tighten the minimum necessary rules; expand the right to restrict certain uses and disclosures of PHI; require accountings of certain disclosures of electronic PHI for treatment, payment or health care operations; establish additional rules regarding the unauthorized sale of PHI and an individual’s access to his or her own PHI maintained electronically; affect what will be considered "marketing" under the privacy rules; require many fundraising materials to inform recipients how they may opt not to receive future communications; and mandate that certain vendors that transmit PHI to a covered entity or business associate enter into business associate agreements and be treated as business associates.

Comments.  Covered entities and business associates will need to take measures to comply with the new requirements. Covered entities will need to modify their business associate agreements. Business associates will be subject to statutory requirements as well as contractual requirements. They will need to consider the documentation necessary to comply with the security rules.

Effective dates vary. Most of the new security rules will take effect later this year (30 days after HHS publishes regulations). Most of the new privacy rules will take effect one year after ARRA is signed into law. The new penalty and enforcement rules are effective immediately.

ARRA includes other provisions that affect health and other welfare benefit arrangements. For example:

Qualified Transportation Fringe Benefits.  ARRA increases the monthly limit on benefits for transit passes and vanpools to the same amount as the limit for qualified parking. For 2009, that means an increase from $120 to $230 per month. This increase will be in effect from March 2009 through December 2010.

Government Health Programs.  ARRA makes various changes to governmental programs, including Medicare, Medicaid, and the Children's Health Insurance Program (CHIP). Other recent legislation has introduced significant changes to CHIP insofar as it relates to employer-sponsored benefits. Various details of those rules, which will allow states to pay part of the premiums for qualifying dependent coverage and may require employers to offer certain special enrollment rights, are still being worked out. We plan to address these matters in a future legal alert. 

For more information on these changes, please contact Edward Leeds (  or 215.864.8419) or any member of Ballard's Employee Benefits and Executive Compensation Group.

Copyright © 2009 by Ballard Spahr LLP.
(No claim to original U.S. government material.)

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise, without prior written permission of the author and publisher.

This newsletter is a periodic publication of Ballard Spahr LLP and is intended to alert the recipients to new developments in the law. It should not be construed as legal advice or legal opinion on any specific facts or circumstances. The contents are intended for general informational purposes only, and you are urged to consult your own lawyer concerning your situation and specific legal questions you have.